<?xml version="1.0" encoding="UTF-8" standalone="no" ?>
<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">

  <anomaly type="notice" value="0.550023,1.93176,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="172.142.200.59" dst_port="137" proto="tcp" src_ip="209.135.47.18" src_port="80"/>
      <filter dst_ip="172.142.200.59" dst_port="137" proto="udp" src_ip="209.135.47.18" src_port="80"/>
      <filter dst_ip="172.142.200.59" dst_port="137" proto="tcp" src_ip="209.135.47.18" src_port="1025"/>
      <filter dst_ip="172.142.200.59" dst_port="137" proto="udp" src_ip="209.135.47.18" src_port="1025"/>
      <from sec="1041397483" usec="0"/>
      <to sec="1041397499" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="172.142.200.59" dst_port="137" proto="tcp" src_ip="90.62.151.18" src_port="80"/>
      <filter dst_ip="172.142.200.59" dst_port="137" proto="udp" src_ip="90.62.151.18" src_port="80"/>
      <filter dst_ip="172.142.200.59" dst_port="137" proto="tcp" src_ip="90.62.151.18" src_port="1025"/>
      <filter dst_ip="172.142.200.59" dst_port="137" proto="udp" src_ip="90.62.151.18" src_port="1025"/>
      <from sec="1041397483" usec="0"/>
      <to sec="1041397499" usec="0"/>
    </slice>
    <from sec="1041397483" usec="0"/>
    <to sec="1041397499" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="141.0.187.243" dst_port="137" proto="tcp" src_ip="218.235.134.45" src_port="1028"/>
      <filter dst_ip="141.0.187.243" dst_port="137" proto="udp" src_ip="218.235.134.45" src_port="1028"/>
      <filter dst_ip="141.0.187.243" dst_port="2064" proto="tcp" src_ip="218.235.134.45" src_port="1028"/>
      <filter dst_ip="141.0.187.243" dst_port="2064" proto="udp" src_ip="218.235.134.45" src_port="1028"/>
      <from sec="1041397576" usec="0"/>
      <to sec="1041397604" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="141.0.187.243" dst_port="137" proto="tcp" src_ip="148.144.206.45" src_port="1028"/>
      <filter dst_ip="141.0.187.243" dst_port="137" proto="udp" src_ip="148.144.206.45" src_port="1028"/>
      <filter dst_ip="141.0.187.243" dst_port="2064" proto="tcp" src_ip="148.144.206.45" src_port="1028"/>
      <filter dst_ip="141.0.187.243" dst_port="2064" proto="udp" src_ip="148.144.206.45" src_port="1028"/>
      <from sec="1041397575" usec="0"/>
      <to sec="1041397605" usec="0"/>
    </slice>
    <from sec="1041397575" usec="0"/>
    <to sec="1041397605" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="6346" proto="tcp" src_ip="148.155.246.77" src_port="6346"/>
      <from sec="1041397201" usec="0"/>
      <to sec="1041398717" usec="0"/>
    </slice>
    <from sec="1041397201" usec="0"/>
    <to sec="1041398717" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="197.90.54.66" dst_port="137" proto="tcp" src_ip="61.226.36.138" src_port="1026"/>
      <filter dst_ip="197.90.54.66" dst_port="137" proto="udp" src_ip="61.226.36.138" src_port="1026"/>
      <filter dst_ip="197.90.54.66" dst_port="80" proto="tcp" src_ip="61.226.36.138" src_port="1026"/>
      <filter dst_ip="197.90.54.66" dst_port="80" proto="udp" src_ip="61.226.36.138" src_port="1026"/>
      <from sec="1041397459" usec="0"/>
      <to sec="1041397496" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="197.90.54.66" dst_port="137" proto="tcp" src_ip="144.52.72.113" src_port="1026"/>
      <filter dst_ip="197.90.54.66" dst_port="137" proto="udp" src_ip="144.52.72.113" src_port="1026"/>
      <filter dst_ip="197.90.54.66" dst_port="80" proto="tcp" src_ip="144.52.72.113" src_port="1026"/>
      <filter dst_ip="197.90.54.66" dst_port="80" proto="udp" src_ip="144.52.72.113" src_port="1026"/>
      <from sec="1041397480" usec="0"/>
      <to sec="1041397489" usec="0"/>
    </slice>
    <from sec="1041397459" usec="0"/>
    <to sec="1041397498" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,503,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="168.125.148.14" dst_port="4001" proto="tcp" src_ip="89.102.71.177" src_port="80"/>
      <from sec="1041397305" usec="0"/>
      <to sec="1041397308" usec="0"/>
    </slice>
    <from sec="1041397305" usec="0"/>
    <to sec="1041397308" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="4.22.107.0" src_port="65197"/>
      <from sec="1041397447" usec="0"/>
      <to sec="1041397464" usec="0"/>
    </slice>
    <from sec="1041397447" usec="0"/>
    <to sec="1041397464" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="61.246.142.3" src_port="1154"/>
      <from sec="1041398029" usec="0"/>
      <to sec="1041398042" usec="0"/>
    </slice>
    <from sec="1041398026" usec="0"/>
    <to sec="1041398042" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,503,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="136.234.119.18" dst_port="137" proto="tcp" src_ip="202.126.220.4" src_port="1025"/>
      <filter dst_ip="136.234.119.18" dst_port="137" proto="udp" src_ip="202.126.220.4" src_port="1025"/>
      <filter dst_ip="136.234.119.18" dst_port="1708" proto="tcp" src_ip="202.126.220.4" src_port="1025"/>
      <filter dst_ip="136.234.119.18" dst_port="1708" proto="udp" src_ip="202.126.220.4" src_port="1025"/>
      <filter dst_ip="136.234.119.18" dst_port="137" proto="tcp" src_ip="202.126.220.4" src_port="80"/>
      <filter dst_ip="136.234.119.18" dst_port="137" proto="udp" src_ip="202.126.220.4" src_port="80"/>
      <filter dst_ip="136.234.119.18" dst_port="1708" proto="tcp" src_ip="202.126.220.4" src_port="80"/>
      <filter dst_ip="136.234.119.18" dst_port="1708" proto="udp" src_ip="202.126.220.4" src_port="80"/>
      <from sec="1041398422" usec="0"/>
      <to sec="1041398437" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="136.234.119.18" dst_port="137" proto="tcp" src_ip="211.137.108.4" src_port="1025"/>
      <filter dst_ip="136.234.119.18" dst_port="137" proto="udp" src_ip="211.137.108.4" src_port="1025"/>
      <filter dst_ip="136.234.119.18" dst_port="1708" proto="tcp" src_ip="211.137.108.4" src_port="1025"/>
      <filter dst_ip="136.234.119.18" dst_port="1708" proto="udp" src_ip="211.137.108.4" src_port="1025"/>
      <filter dst_ip="136.234.119.18" dst_port="137" proto="tcp" src_ip="211.137.108.4" src_port="80"/>
      <filter dst_ip="136.234.119.18" dst_port="137" proto="udp" src_ip="211.137.108.4" src_port="80"/>
      <filter dst_ip="136.234.119.18" dst_port="1708" proto="tcp" src_ip="211.137.108.4" src_port="80"/>
      <filter dst_ip="136.234.119.18" dst_port="1708" proto="udp" src_ip="211.137.108.4" src_port="80"/>
      <from sec="1041398430" usec="0"/>
      <to sec="1041398432" usec="0"/>
    </slice>
    <from sec="1041398422" usec="0"/>
    <to sec="1041398437" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="203.123.5.5" src_port="1024"/>
      <from sec="1041398287" usec="0"/>
      <to sec="1041398306" usec="0"/>
    </slice>
    <from sec="1041398287" usec="0"/>
    <to sec="1041398315" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="202.159.192.25" dst_port="137" proto="tcp" src_ip="61.161.206.11" src_port="1026"/>
      <filter dst_ip="202.159.192.25" dst_port="137" proto="udp" src_ip="61.161.206.11" src_port="1026"/>
      <filter dst_ip="202.159.192.25" dst_port="137" proto="tcp" src_ip="61.161.206.11" src_port="8080"/>
      <filter dst_ip="202.159.192.25" dst_port="137" proto="udp" src_ip="61.161.206.11" src_port="8080"/>
      <from sec="1041397564" usec="0"/>
      <to sec="1041397587" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="202.159.192.25" dst_port="137" proto="tcp" src_ip="203.37.98.11" src_port="1026"/>
      <filter dst_ip="202.159.192.25" dst_port="137" proto="udp" src_ip="203.37.98.11" src_port="1026"/>
      <filter dst_ip="202.159.192.25" dst_port="137" proto="tcp" src_ip="203.37.98.11" src_port="8080"/>
      <filter dst_ip="202.159.192.25" dst_port="137" proto="udp" src_ip="203.37.98.11" src_port="8080"/>
      <from sec="1041397561" usec="0"/>
      <to sec="1041397589" usec="0"/>
    </slice>
    <from sec="1041397561" usec="0"/>
    <to sec="1041397589" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="90.32.148.13" src_port="25455"/>
      <from sec="1041398225" usec="0"/>
      <to sec="1041398235" usec="0"/>
    </slice>
    <from sec="1041398225" usec="0"/>
    <to sec="1041398235" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="216.73.227.14" src_port="1028"/>
      <from sec="1041398515" usec="0"/>
      <to sec="1041398526" usec="0"/>
    </slice>
    <from sec="1041398515" usec="0"/>
    <to sec="1041398526" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="217.57.130.24" src_port="1028"/>
      <from sec="1041398515" usec="0"/>
      <to sec="1041398532" usec="0"/>
    </slice>
    <from sec="1041398515" usec="0"/>
    <to sec="1041398532" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="203.250.203.26" src_port="62930"/>
      <from sec="1041398082" usec="0"/>
      <to sec="1041398099" usec="0"/>
    </slice>
    <from sec="1041398082" usec="0"/>
    <to sec="1041398099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="90.222.52.137" dst_port="137" proto="udp" src_ip="89.239.65.27" src_port="1027"/>
      <filter dst_ip="90.222.52.137" dst_port="137" proto="icmp" src_ip="89.239.65.27" src_port="1027"/>
      <from sec="1041398134" usec="0"/>
      <to sec="1041398143" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="90.222.52.137" dst_port="137" proto="udp" src_ip="172.142.73.27" src_port="1027"/>
      <filter dst_ip="90.222.52.137" dst_port="137" proto="icmp" src_ip="172.142.73.27" src_port="1027"/>
      <from sec="1041398127" usec="0"/>
      <to sec="1041398133" usec="0"/>
    </slice>
    <from sec="1041398127" usec="0"/>
    <to sec="1041398143" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="4.149.12.31" src_port="1027"/>
      <from sec="1041397362" usec="0"/>
      <to sec="1041397369" usec="0"/>
    </slice>
    <from sec="1041397362" usec="0"/>
    <to sec="1041397369" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="61.143.229.32" src_port="1028"/>
      <from sec="1041398269" usec="0"/>
      <to sec="1041398282" usec="0"/>
    </slice>
    <from sec="1041398269" usec="0"/>
    <to sec="1041398282" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="4.26.186.34" src_port="1025"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="4.26.186.34" src_port="1025"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="4.26.186.34" src_port="80"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="4.26.186.34" src_port="80"/>
      <from sec="1041398483" usec="0"/>
      <to sec="1041398511" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="218.159.150.34" src_port="1025"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="218.159.150.34" src_port="1025"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="218.159.150.34" src_port="80"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="218.159.150.34" src_port="80"/>
      <from sec="1041398485" usec="0"/>
      <to sec="1041398516" usec="0"/>
    </slice>
    <from sec="1041398483" usec="0"/>
    <to sec="1041398516" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="61.206.116.42" src_port="10968"/>
      <from sec="1041398235" usec="0"/>
      <to sec="1041398275" usec="0"/>
    </slice>
    <from sec="1041398235" usec="0"/>
    <to sec="1041398275" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="194.196.30.44" src_port="1031"/>
      <from sec="1041398665" usec="0"/>
      <to sec="1041398671" usec="0"/>
    </slice>
    <from sec="1041398665" usec="0"/>
    <to sec="1041398671" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,503,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="88.212.112.164" dst_port="137" proto="tcp" src_ip="91.81.62.44" src_port="1027"/>
      <filter dst_ip="88.212.112.164" dst_port="137" proto="udp" src_ip="91.81.62.44" src_port="1027"/>
      <filter dst_ip="88.212.112.164" dst_port="26434" proto="tcp" src_ip="91.81.62.44" src_port="1027"/>
      <filter dst_ip="88.212.112.164" dst_port="26434" proto="udp" src_ip="91.81.62.44" src_port="1027"/>
      <filter dst_ip="88.212.112.164" dst_port="137" proto="tcp" src_ip="91.81.62.44" src_port="80"/>
      <filter dst_ip="88.212.112.164" dst_port="137" proto="udp" src_ip="91.81.62.44" src_port="80"/>
      <filter dst_ip="88.212.112.164" dst_port="26434" proto="tcp" src_ip="91.81.62.44" src_port="80"/>
      <filter dst_ip="88.212.112.164" dst_port="26434" proto="udp" src_ip="91.81.62.44" src_port="80"/>
      <from sec="1041398319" usec="0"/>
      <to sec="1041398331" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="88.212.112.164" dst_port="137" proto="tcp" src_ip="203.59.18.44" src_port="1027"/>
      <filter dst_ip="88.212.112.164" dst_port="137" proto="udp" src_ip="203.59.18.44" src_port="1027"/>
      <filter dst_ip="88.212.112.164" dst_port="26434" proto="tcp" src_ip="203.59.18.44" src_port="1027"/>
      <filter dst_ip="88.212.112.164" dst_port="26434" proto="udp" src_ip="203.59.18.44" src_port="1027"/>
      <filter dst_ip="88.212.112.164" dst_port="137" proto="tcp" src_ip="203.59.18.44" src_port="80"/>
      <filter dst_ip="88.212.112.164" dst_port="137" proto="udp" src_ip="203.59.18.44" src_port="80"/>
      <filter dst_ip="88.212.112.164" dst_port="26434" proto="tcp" src_ip="203.59.18.44" src_port="80"/>
      <filter dst_ip="88.212.112.164" dst_port="26434" proto="udp" src_ip="203.59.18.44" src_port="80"/>
      <from sec="1041398325" usec="0"/>
      <to sec="1041398327" usec="0"/>
    </slice>
    <from sec="1041398319" usec="0"/>
    <to sec="1041398331" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="89.198.215.44" src_port="64443"/>
      <from sec="1041398001" usec="0"/>
      <to sec="1041398014" usec="0"/>
    </slice>
    <from sec="1041398001" usec="0"/>
    <to sec="1041398014" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_22{
style=filled;
color=gray75;
196[label="217.70.1.47s;85pkt 85fpkt", shape=rectangle, color=red];
stat22[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.70.1.47:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
196--3276[label="0.0117647;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.70.1.47" src_port="1026"/>
    </slice>
    <from sec="1041397596" usec="0"/>
    <to sec="1041397620" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="70.148.102.47" src_port="11972"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="70.148.102.47" src_port="11972"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="70.148.102.47" src_port="80"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="70.148.102.47" src_port="80"/>
      <from sec="1041398589" usec="0"/>
      <to sec="1041398625" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="218.159.150.47" src_port="11972"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="218.159.150.47" src_port="11972"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="218.159.150.47" src_port="80"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="218.159.150.47" src_port="80"/>
      <from sec="1041398585" usec="0"/>
      <to sec="1041398631" usec="0"/>
    </slice>
    <from sec="1041398585" usec="0"/>
    <to sec="1041398632" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="217.53.239.51" src_port="1025"/>
      <from sec="1041398782" usec="0"/>
      <to sec="1041398789" usec="0"/>
    </slice>
    <from sec="1041398782" usec="0"/>
    <to sec="1041398798" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="tcp" src_ip="212.247.138.55" src_port="1027"/>
      <filter dst_port="137" proto="udp" src_ip="212.247.138.55" src_port="1027"/>
      <from sec="1041398033" usec="0"/>
      <to sec="1041398067" usec="0"/>
    </slice>
    <from sec="1041398033" usec="0"/>
    <to sec="1041398067" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="91.97.107.56" src_port="33389"/>
      <from sec="1041398435" usec="0"/>
      <to sec="1041398457" usec="0"/>
    </slice>
    <from sec="1041398435" usec="0"/>
    <to sec="1041398457" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="202.198.15.58" src_port="54361"/>
      <from sec="1041398782" usec="0"/>
      <to sec="1041398790" usec="0"/>
    </slice>
    <from sec="1041398782" usec="0"/>
    <to sec="1041398790" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="61.99.195.58" src_port="1051"/>
      <from sec="1041397444" usec="0"/>
      <to sec="1041397452" usec="0"/>
    </slice>
    <from sec="1041397444" usec="0"/>
    <to sec="1041397455" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.946667,1.87498,999,1 1 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_29{
style=filled;
color=gray75;
228[label="193.41.88.67s;1pkt 1fpkt", shape=rectangle, color=red];
232[label="195.53.180.67s;1pkt 1fpkt", shape=rectangle, color=red];
861[label="61.244.8.67s;2pkt 2fpkt", shape=ellipse, color=green];
863[label="193.41.88.67s;1pkt 1fpkt", shape=ellipse, color=green];
1353[label="61.244.8.67s;1pkt 1fpkt", shape=triangle, color=blue];
1355[label="193.41.88.67s;1pkt 1fpkt", shape=triangle, color=blue];
2014[label="136.234.78.149;d;1463pkt 1463fpkt", shape=diamond, color=yellow];
2541[label="213.4.168.67;s;2pkt 2fpkt", shape=diamond, color=yellow];
stat29[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.46.54.115:*, 136.234.78.149:*}[99.0437%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (0.509511%)&lt;BR/&gt; 3221: (0.203804%)&lt;BR/&gt; 0: (0.203804%)&lt;BR/&gt; 4122: (0.13587%)&lt;BR/&gt; 59092: (0.0339674%)&gt;];
}
228--232[label="1;1pkt 1fpkt"];
228--863[label="1;1pkt 1fpkt"];
228--1355[label="1;1pkt 1fpkt"];
228--2014[label="1;1pkt 1fpkt"];
228--2541[label="1;1pkt 1fpkt"];
232--863[label="1;1pkt 1fpkt"];
232--1355[label="1;1pkt 1fpkt"];
232--2014[label="1;1pkt 1fpkt"];
232--2541[label="1;1pkt 1fpkt"];
861--1353[label="1;1pkt 1fpkt"];
861--2014[label="0.5;1pkt 1fpkt"];
861--2541[label="0.5;1pkt 1fpkt"];
863--1355[label="1;1pkt 1fpkt"];
863--2014[label="1;1pkt 1fpkt"];
863--2541[label="1;1pkt 1fpkt"];
1353--2014[label="1;1pkt 1fpkt"];
1353--2541[label="1;1pkt 1fpkt"];
1355--2014[label="1;1pkt 1fpkt"];
1355--2541[label="1;1pkt 1fpkt"];
2014--2018[label="1;1450pkt 1450fpkt"];
2014--2541[label="1;2pkt 2fpkt"];
2014--2824[label="1;34pkt 34fpkt"];
2014--2829[label="1;33pkt 33fpkt"];
2014--3235[label="1;34pkt 34fpkt"];
2014--4686[label="0.990431;1449pkt 1449fpkt"];
2014--5137[label="0.990431;1449pkt 1449fpkt"];
</description>
    <slice>
      <filter dst_ip="136.234.78.149" src_ip="206.46.54.115"/>
    </slice>
    <from sec="1041397211" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="90.8.49.68" src_port="1135"/>
      <from sec="1041398791" usec="0"/>
      <to sec="1041398800" usec="0"/>
    </slice>
    <from sec="1041398787" usec="0"/>
    <to sec="1041398800" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="61.140.200.71" src_port="1025"/>
      <from sec="1041398331" usec="0"/>
      <to sec="1041398343" usec="0"/>
    </slice>
    <from sec="1041398331" usec="0"/>
    <to sec="1041398343" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="210.226.19.76" src_port="1025"/>
      <from sec="1041398590" usec="0"/>
      <to sec="1041398597" usec="0"/>
    </slice>
    <from sec="1041398590" usec="0"/>
    <to sec="1041398599" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="61.136.146.83" src_port="1029"/>
      <from sec="1041398345" usec="0"/>
      <to sec="1041398358" usec="0"/>
    </slice>
    <from sec="1041398345" usec="0"/>
    <to sec="1041398358" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="61.81.68.84" src_port="1040"/>
      <from sec="1041397387" usec="0"/>
      <to sec="1041397393" usec="0"/>
    </slice>
    <from sec="1041397387" usec="0"/>
    <to sec="1041397396" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="195.250.187.86" src_port="1073"/>
      <from sec="1041397870" usec="0"/>
      <to sec="1041397879" usec="0"/>
    </slice>
    <from sec="1041397870" usec="0"/>
    <to sec="1041397879" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="203.102.150.88" src_port="1027"/>
      <from sec="1041398517" usec="0"/>
      <to sec="1041398557" usec="0"/>
    </slice>
    <from sec="1041398517" usec="0"/>
    <to sec="1041398557" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="210.178.100.93" src_port="1026"/>
      <from sec="1041398182" usec="0"/>
      <to sec="1041398189" usec="0"/>
    </slice>
    <from sec="1041398182" usec="0"/>
    <to sec="1041398189" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="213.187.98.97" src_port="1028"/>
      <filter dst_port="137" proto="udp" src_ip="213.187.98.97" src_port="1031"/>
      <from sec="1041398700" usec="0"/>
      <to sec="1041398705" usec="0"/>
    </slice>
    <slice>
      <filter dst_port="137" proto="udp" src_ip="63.59.114.98" src_port="1028"/>
      <filter dst_port="137" proto="udp" src_ip="63.59.114.98" src_port="1031"/>
      <from sec="1041398707" usec="0"/>
      <to sec="1041398712" usec="0"/>
    </slice>
    <from sec="1041398700" usec="0"/>
    <to sec="1041398712" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="61.141.135.102" src_port="1028"/>
      <from sec="1041397829" usec="0"/>
      <to sec="1041397837" usec="0"/>
    </slice>
    <from sec="1041397829" usec="0"/>
    <to sec="1041397838" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="210.60.5.108" src_port="1026"/>
      <from sec="1041397895" usec="0"/>
      <to sec="1041397901" usec="0"/>
    </slice>
    <from sec="1041397895" usec="0"/>
    <to sec="1041397901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="172.142.200.59" dst_port="137" proto="tcp" src_ip="203.37.124.109" src_port="1029"/>
      <filter dst_ip="172.142.200.59" dst_port="137" proto="udp" src_ip="203.37.124.109" src_port="1029"/>
      <filter dst_ip="172.142.200.59" dst_port="137" proto="tcp" src_ip="203.37.124.109" src_port="80"/>
      <filter dst_ip="172.142.200.59" dst_port="137" proto="udp" src_ip="203.37.124.109" src_port="80"/>
      <from sec="1041397224" usec="0"/>
      <to sec="1041397247" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="172.142.200.59" dst_port="137" proto="tcp" src_ip="195.241.248.109" src_port="1029"/>
      <filter dst_ip="172.142.200.59" dst_port="137" proto="udp" src_ip="195.241.248.109" src_port="1029"/>
      <filter dst_ip="172.142.200.59" dst_port="137" proto="tcp" src_ip="195.241.248.109" src_port="80"/>
      <filter dst_ip="172.142.200.59" dst_port="137" proto="udp" src_ip="195.241.248.109" src_port="80"/>
      <from sec="1041397234" usec="0"/>
      <to sec="1041397248" usec="0"/>
    </slice>
    <from sec="1041397224" usec="0"/>
    <to sec="1041397248" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="202.159.194.95" dst_port="137" proto="tcp" src_ip="133.209.83.119" src_port="1033"/>
      <filter dst_ip="202.159.194.95" dst_port="137" proto="udp" src_ip="133.209.83.119" src_port="1033"/>
      <filter dst_ip="202.159.194.95" dst_port="137" proto="tcp" src_ip="133.209.83.119" src_port="80"/>
      <filter dst_ip="202.159.194.95" dst_port="137" proto="udp" src_ip="133.209.83.119" src_port="80"/>
      <from sec="1041397587" usec="0"/>
      <to sec="1041397624" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="202.159.194.95" dst_port="137" proto="tcp" src_ip="213.26.139.119" src_port="1033"/>
      <filter dst_ip="202.159.194.95" dst_port="137" proto="udp" src_ip="213.26.139.119" src_port="1033"/>
      <filter dst_ip="202.159.194.95" dst_port="137" proto="tcp" src_ip="213.26.139.119" src_port="80"/>
      <filter dst_ip="202.159.194.95" dst_port="137" proto="udp" src_ip="213.26.139.119" src_port="80"/>
      <from sec="1041397590" usec="0"/>
      <to sec="1041397620" usec="0"/>
    </slice>
    <from sec="1041397587" usec="0"/>
    <to sec="1041397624" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="4.134.190.126" src_port="1025"/>
      <from sec="1041397905" usec="0"/>
      <to sec="1041397912" usec="0"/>
    </slice>
    <from sec="1041397905" usec="0"/>
    <to sec="1041397912" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="tcp" src_ip="217.128.75.129" src_port="1031"/>
      <filter dst_port="137" proto="udp" src_ip="217.128.75.129" src_port="1031"/>
      <filter dst_port="137" proto="tcp" src_ip="217.128.75.129" src_port="80"/>
      <filter dst_port="137" proto="udp" src_ip="217.128.75.129" src_port="80"/>
      <from sec="1041397918" usec="0"/>
      <to sec="1041397927" usec="0"/>
    </slice>
    <from sec="1041397918" usec="0"/>
    <to sec="1041397935" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="90.16.164.129" src_port="1032"/>
      <from sec="1041398041" usec="0"/>
      <to sec="1041398056" usec="0"/>
    </slice>
    <from sec="1041398041" usec="0"/>
    <to sec="1041398056" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="213.185.91.131" src_port="1025"/>
      <from sec="1041397609" usec="0"/>
      <to sec="1041397627" usec="0"/>
    </slice>
    <from sec="1041397609" usec="0"/>
    <to sec="1041397635" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="148.199.192.38" dst_port="137" proto="udp" src_ip="61.160.110.131" src_port="1029"/>
      <filter dst_ip="148.199.192.38" dst_port="137" proto="icmp" src_ip="61.160.110.131" src_port="1029"/>
      <from sec="1041397516" usec="0"/>
      <to sec="1041397526" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="148.199.192.38" dst_port="137" proto="udp" src_ip="207.17.178.131" src_port="1029"/>
      <filter dst_ip="148.199.192.38" dst_port="137" proto="icmp" src_ip="207.17.178.131" src_port="1029"/>
      <from sec="1041397515" usec="0"/>
      <to sec="1041397532" usec="0"/>
    </slice>
    <from sec="1041397515" usec="0"/>
    <to sec="1041397532" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="61.202.28.132" src_port="1433"/>
      <from sec="1041397330" usec="0"/>
      <to sec="1041397336" usec="0"/>
    </slice>
    <from sec="1041397330" usec="0"/>
    <to sec="1041397336" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="192.211.37.53" dst_port="137" proto="tcp" src_ip="211.65.99.133" src_port="62414"/>
      <filter dst_ip="192.211.37.53" dst_port="137" proto="udp" src_ip="211.65.99.133" src_port="62414"/>
      <filter dst_ip="192.211.37.53" dst_port="80" proto="tcp" src_ip="211.65.99.133" src_port="62414"/>
      <filter dst_ip="192.211.37.53" dst_port="80" proto="udp" src_ip="211.65.99.133" src_port="62414"/>
      <from sec="1041397768" usec="0"/>
      <to sec="1041397784" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="192.211.37.53" dst_port="137" proto="tcp" src_ip="136.234.91.133" src_port="62414"/>
      <filter dst_ip="192.211.37.53" dst_port="137" proto="udp" src_ip="136.234.91.133" src_port="62414"/>
      <filter dst_ip="192.211.37.53" dst_port="80" proto="tcp" src_ip="136.234.91.133" src_port="62414"/>
      <filter dst_ip="192.211.37.53" dst_port="80" proto="udp" src_ip="136.234.91.133" src_port="62414"/>
      <from sec="1041397768" usec="0"/>
      <to sec="1041397781" usec="0"/>
    </slice>
    <from sec="1041397768" usec="0"/>
    <to sec="1041397784" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="168.125.47.240" dst_port="137" proto="tcp" src_ip="61.217.152.133" src_port="1026"/>
      <filter dst_ip="168.125.47.240" dst_port="137" proto="udp" src_ip="61.217.152.133" src_port="1026"/>
      <filter dst_ip="168.125.47.240" dst_port="2726" proto="tcp" src_ip="61.217.152.133" src_port="1026"/>
      <filter dst_ip="168.125.47.240" dst_port="2726" proto="udp" src_ip="61.217.152.133" src_port="1026"/>
      <filter dst_ip="168.125.47.240" dst_port="137" proto="tcp" src_ip="61.217.152.133" src_port="4662"/>
      <filter dst_ip="168.125.47.240" dst_port="137" proto="udp" src_ip="61.217.152.133" src_port="4662"/>
      <filter dst_ip="168.125.47.240" dst_port="2726" proto="tcp" src_ip="61.217.152.133" src_port="4662"/>
      <filter dst_ip="168.125.47.240" dst_port="2726" proto="udp" src_ip="61.217.152.133" src_port="4662"/>
      <from sec="1041398747" usec="0"/>
      <to sec="1041398753" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="168.125.47.240" dst_port="137" proto="tcp" src_ip="213.233.184.133" src_port="1026"/>
      <filter dst_ip="168.125.47.240" dst_port="137" proto="udp" src_ip="213.233.184.133" src_port="1026"/>
      <filter dst_ip="168.125.47.240" dst_port="2726" proto="tcp" src_ip="213.233.184.133" src_port="1026"/>
      <filter dst_ip="168.125.47.240" dst_port="2726" proto="udp" src_ip="213.233.184.133" src_port="1026"/>
      <filter dst_ip="168.125.47.240" dst_port="137" proto="tcp" src_ip="213.233.184.133" src_port="4662"/>
      <filter dst_ip="168.125.47.240" dst_port="137" proto="udp" src_ip="213.233.184.133" src_port="4662"/>
      <filter dst_ip="168.125.47.240" dst_port="2726" proto="tcp" src_ip="213.233.184.133" src_port="4662"/>
      <filter dst_ip="168.125.47.240" dst_port="2726" proto="udp" src_ip="213.233.184.133" src_port="4662"/>
      <from sec="1041398755" usec="0"/>
      <to sec="1041398758" usec="0"/>
    </slice>
    <from sec="1041398747" usec="0"/>
    <to sec="1041398758" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="89.238.204.134" src_port="1028"/>
      <from sec="1041398392" usec="0"/>
      <to sec="1041398398" usec="0"/>
    </slice>
    <from sec="1041398392" usec="0"/>
    <to sec="1041398406" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="93.229.66.139" src_port="1027"/>
      <filter dst_port="137" proto="udp" src_ip="93.229.66.139" src_port="1048"/>
      <from sec="1041398424" usec="0"/>
      <to sec="1041398809" usec="0"/>
    </slice>
    <from sec="1041398424" usec="0"/>
    <to sec="1041398809" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="217.67.82.139" src_port="1025"/>
      <from sec="1041398160" usec="0"/>
      <to sec="1041398196" usec="0"/>
    </slice>
    <from sec="1041398160" usec="0"/>
    <to sec="1041398196" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="202.233.225.123" dst_port="137" proto="tcp" src_ip="4.146.24.140" src_port="1034"/>
      <filter dst_ip="202.233.225.123" dst_port="137" proto="udp" src_ip="4.146.24.140" src_port="1034"/>
      <filter dst_ip="202.233.225.123" dst_port="137" proto="tcp" src_ip="4.146.24.140" src_port="1026"/>
      <filter dst_ip="202.233.225.123" dst_port="137" proto="udp" src_ip="4.146.24.140" src_port="1026"/>
      <filter dst_ip="202.233.225.123" dst_port="137" proto="tcp" src_ip="4.146.24.140" src_port="25"/>
      <filter dst_ip="202.233.225.123" dst_port="137" proto="udp" src_ip="4.146.24.140" src_port="25"/>
      <from sec="1041397949" usec="0"/>
      <to sec="1041398308" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="202.233.225.123" dst_port="137" proto="tcp" src_ip="172.142.208.140" src_port="1034"/>
      <filter dst_ip="202.233.225.123" dst_port="137" proto="udp" src_ip="172.142.208.140" src_port="1034"/>
      <filter dst_ip="202.233.225.123" dst_port="137" proto="tcp" src_ip="172.142.208.140" src_port="1026"/>
      <filter dst_ip="202.233.225.123" dst_port="137" proto="udp" src_ip="172.142.208.140" src_port="1026"/>
      <filter dst_ip="202.233.225.123" dst_port="137" proto="tcp" src_ip="172.142.208.140" src_port="25"/>
      <filter dst_ip="202.233.225.123" dst_port="137" proto="udp" src_ip="172.142.208.140" src_port="25"/>
      <from sec="1041397956" usec="0"/>
      <to sec="1041398304" usec="0"/>
    </slice>
    <from sec="1041397949" usec="0"/>
    <to sec="1041398308" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="199.96.89.144" src_port="31256"/>
      <from sec="1041397570" usec="0"/>
      <to sec="1041397584" usec="0"/>
    </slice>
    <from sec="1041397570" usec="0"/>
    <to sec="1041397586" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="217.79.44.145" src_port="1029"/>
      <from sec="1041398219" usec="0"/>
      <to sec="1041398229" usec="0"/>
    </slice>
    <from sec="1041398219" usec="0"/>
    <to sec="1041398229" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="202.91.71.145" src_port="1025"/>
      <from sec="1041398515" usec="0"/>
      <to sec="1041398523" usec="0"/>
    </slice>
    <from sec="1041398515" usec="0"/>
    <to sec="1041398523" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="71.139.90.147" src_port="1044"/>
      <from sec="1041397460" usec="0"/>
      <to sec="1041397476" usec="0"/>
    </slice>
    <from sec="1041397460" usec="0"/>
    <to sec="1041397484" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="61.231.6.148" src_port="1025"/>
      <from sec="1041398168" usec="0"/>
      <to sec="1041398184" usec="0"/>
    </slice>
    <from sec="1041398168" usec="0"/>
    <to sec="1041398184" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="216.241.154.148" src_port="1030"/>
      <from sec="1041398162" usec="0"/>
      <to sec="1041398176" usec="0"/>
    </slice>
    <from sec="1041398162" usec="0"/>
    <to sec="1041398176" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="211.220.58.153" src_port="1029"/>
      <from sec="1041398222" usec="0"/>
      <to sec="1041398250" usec="0"/>
    </slice>
    <from sec="1041398222" usec="0"/>
    <to sec="1041398250" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="61.216.162.155" src_port="1026"/>
      <from sec="1041397315" usec="0"/>
      <to sec="1041397327" usec="0"/>
    </slice>
    <from sec="1041397315" usec="0"/>
    <to sec="1041397327" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="203.122.211.158" src_port="1026"/>
      <from sec="1041397373" usec="0"/>
      <to sec="1041397379" usec="0"/>
    </slice>
    <from sec="1041397373" usec="0"/>
    <to sec="1041397388" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="202.30.201.168" src_port="1025"/>
      <from sec="1041397516" usec="0"/>
      <to sec="1041397529" usec="0"/>
    </slice>
    <from sec="1041397516" usec="0"/>
    <to sec="1041397529" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="217.63.40.169" src_port="1025"/>
      <from sec="1041398284" usec="0"/>
      <to sec="1041398293" usec="0"/>
    </slice>
    <from sec="1041398284" usec="0"/>
    <to sec="1041398294" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="217.132.176.169" src_port="1027"/>
      <from sec="1041397982" usec="0"/>
      <to sec="1041397989" usec="0"/>
    </slice>
    <from sec="1041397982" usec="0"/>
    <to sec="1041397989" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="219.12.97.170" src_port="1031"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="219.12.97.170" src_port="1031"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="219.12.97.170" src_port="80"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="219.12.97.170" src_port="80"/>
      <from sec="1041398175" usec="0"/>
      <to sec="1041398199" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="208.153.81.170" src_port="1031"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="208.153.81.170" src_port="1031"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="208.153.81.170" src_port="80"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="208.153.81.170" src_port="80"/>
      <from sec="1041398182" usec="0"/>
      <to sec="1041398205" usec="0"/>
    </slice>
    <from sec="1041398175" usec="0"/>
    <to sec="1041398205" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="217.32.84.178" src_port="1025"/>
      <from sec="1041398631" usec="0"/>
      <to sec="1041398637" usec="0"/>
    </slice>
    <from sec="1041398631" usec="0"/>
    <to sec="1041398637" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="61.254.104.182" src_port="1029"/>
      <from sec="1041397953" usec="0"/>
      <to sec="1041397962" usec="0"/>
    </slice>
    <from sec="1041397951" usec="0"/>
    <to sec="1041397962" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="61.220.206.189" src_port="1026"/>
      <from sec="1041397870" usec="0"/>
      <to sec="1041397878" usec="0"/>
    </slice>
    <from sec="1041397870" usec="0"/>
    <to sec="1041397878" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="88.86.194.194" src_port="1026"/>
      <from sec="1041397768" usec="0"/>
      <to sec="1041397774" usec="0"/>
    </slice>
    <from sec="1041397768" usec="0"/>
    <to sec="1041397780" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="210.138.66.195" src_port="1027"/>
      <from sec="1041398318" usec="0"/>
      <to sec="1041398338" usec="0"/>
    </slice>
    <from sec="1041398318" usec="0"/>
    <to sec="1041398338" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="211.123.159.115" dst_port="137" proto="tcp" src_ip="205.138.51.196" src_port="1026"/>
      <filter dst_ip="211.123.159.115" dst_port="137" proto="udp" src_ip="205.138.51.196" src_port="1026"/>
      <filter dst_ip="211.123.159.115" dst_port="80" proto="tcp" src_ip="205.138.51.196" src_port="1026"/>
      <filter dst_ip="211.123.159.115" dst_port="80" proto="udp" src_ip="205.138.51.196" src_port="1026"/>
      <from sec="1041398506" usec="0"/>
      <to sec="1041398524" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="211.123.159.115" dst_port="137" proto="tcp" src_ip="168.125.147.196" src_port="1026"/>
      <filter dst_ip="211.123.159.115" dst_port="137" proto="udp" src_ip="168.125.147.196" src_port="1026"/>
      <filter dst_ip="211.123.159.115" dst_port="80" proto="tcp" src_ip="168.125.147.196" src_port="1026"/>
      <filter dst_ip="211.123.159.115" dst_port="80" proto="udp" src_ip="168.125.147.196" src_port="1026"/>
      <from sec="1041398503" usec="0"/>
      <to sec="1041398531" usec="0"/>
    </slice>
    <from sec="1041398503" usec="0"/>
    <to sec="1041398531" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="220.208.162.197" src_port="1026"/>
      <from sec="1041397359" usec="0"/>
      <to sec="1041397373" usec="0"/>
    </slice>
    <from sec="1041397359" usec="0"/>
    <to sec="1041397373" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="217.77.105.200" src_port="1026"/>
      <from sec="1041397487" usec="0"/>
      <to sec="1041397497" usec="0"/>
    </slice>
    <from sec="1041397487" usec="0"/>
    <to sec="1041397497" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="61.226.25.210" src_port="1031"/>
      <from sec="1041397445" usec="0"/>
      <to sec="1041397456" usec="0"/>
    </slice>
    <from sec="1041397444" usec="0"/>
    <to sec="1041397456" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="61.93.47.217" src_port="1088"/>
      <from sec="1041397444" usec="0"/>
      <to sec="1041397451" usec="0"/>
    </slice>
    <from sec="1041397444" usec="0"/>
    <to sec="1041397453" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="213.220.0.218" src_port="1046"/>
      <from sec="1041398549" usec="0"/>
      <to sec="1041398560" usec="0"/>
    </slice>
    <from sec="1041398549" usec="0"/>
    <to sec="1041398562" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="tcp" src_ip="4.18.40.220" src_port="1141"/>
      <filter dst_port="137" proto="udp" src_ip="4.18.40.220" src_port="1141"/>
      <from sec="1041398712" usec="0"/>
      <to sec="1041398720" usec="0"/>
    </slice>
    <from sec="1041398712" usec="0"/>
    <to sec="1041398729" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="70.154.148.222" src_port="1036"/>
      <from sec="1041397626" usec="0"/>
      <to sec="1041397632" usec="0"/>
    </slice>
    <from sec="1041397626" usec="0"/>
    <to sec="1041397635" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="219.15.54.224" src_port="1025"/>
      <from sec="1041398073" usec="0"/>
      <to sec="1041398080" usec="0"/>
    </slice>
    <slice>
      <filter dst_port="137" proto="udp" src_ip="202.159.214.224" src_port="1025"/>
      <from sec="1041398074" usec="0"/>
      <to sec="1041398085" usec="0"/>
    </slice>
    <from sec="1041398073" usec="0"/>
    <to sec="1041398088" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="70.181.100.224" src_port="10004"/>
      <from sec="1041398535" usec="0"/>
      <to sec="1041398541" usec="0"/>
    </slice>
    <from sec="1041398533" usec="0"/>
    <to sec="1041398541" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="209.55.75.226" src_port="1025"/>
      <from sec="1041398648" usec="0"/>
      <to sec="1041398666" usec="0"/>
    </slice>
    <from sec="1041398648" usec="0"/>
    <to sec="1041398666" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="61.234.173.239" src_port="1027"/>
      <filter dst_port="6257" proto="udp" src_ip="61.234.173.239" src_port="1027"/>
      <filter dst_port="137" proto="udp" src_ip="61.234.173.239" src_port="6257"/>
      <filter dst_port="6257" proto="udp" src_ip="61.234.173.239" src_port="6257"/>
      <from sec="1041398133" usec="0"/>
      <to sec="1041398143" usec="0"/>
    </slice>
    <from sec="1041398129" usec="0"/>
    <to sec="1041398143" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="203.59.21.3" dst_port="137" proto="udp" src_ip="91.33.129.240" src_port="1027"/>
      <filter dst_ip="203.59.21.3" dst_port="53" proto="udp" src_ip="91.33.129.240" src_port="1027"/>
      <from sec="1041398648" usec="0"/>
      <to sec="1041398664" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="203.59.21.3" dst_port="137" proto="udp" src_ip="218.74.197.240" src_port="1027"/>
      <filter dst_ip="203.59.21.3" dst_port="53" proto="udp" src_ip="218.74.197.240" src_port="1027"/>
      <from sec="1041398649" usec="0"/>
      <to sec="1041398656" usec="0"/>
    </slice>
    <from sec="1041398648" usec="0"/>
    <to sec="1041398666" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="216.241.213.250" src_port="1030"/>
      <from sec="1041397911" usec="0"/>
      <to sec="1041397918" usec="0"/>
    </slice>
    <from sec="1041397911" usec="0"/>
    <to sec="1041397918" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="170.246.40.251" src_port="1030"/>
      <from sec="1041398353" usec="0"/>
      <to sec="1041398359" usec="0"/>
    </slice>
    <from sec="1041398351" usec="0"/>
    <to sec="1041398359" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="198.142.123.47" dst_port="137" proto="udp" src_ip="90.8.225.34"/>
      <filter dst_ip="198.142.123.47" dst_port="137" proto="icmp" src_ip="90.8.225.34"/>
      <from sec="1041398789" usec="0"/>
      <to sec="1041398799" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="198.142.123.47" dst_port="137" proto="udp" src_ip="144.52.225.34"/>
      <filter dst_ip="198.142.123.47" dst_port="137" proto="icmp" src_ip="144.52.225.34"/>
      <from sec="1041398785" usec="0"/>
      <to sec="1041398799" usec="0"/>
    </slice>
    <from sec="1041398785" usec="0"/>
    <to sec="1041398799" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="61.250.13.173"/>
      <from sec="1041398142" usec="0"/>
      <to sec="1041398150" usec="0"/>
    </slice>
    <from sec="1041398142" usec="0"/>
    <to sec="1041398156" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="154.179.115.224"/>
      <from sec="1041398812" usec="0"/>
      <to sec="1041398819" usec="0"/>
    </slice>
    <from sec="1041398804" usec="0"/>
    <to sec="1041398819" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="203.43.145.112" proto="tcp" src_ip="168.125.47.240"/>
      <filter dst_ip="203.43.145.112" proto="icmp" src_ip="168.125.47.240"/>
      <filter dst_ip="203.43.145.112" proto="tcp" src_ip="168.125.47.240"/>
      <filter dst_ip="203.43.145.112" proto="icmp" src_ip="168.125.47.240"/>
      <filter dst_ip="203.43.145.112" proto="tcp" src_ip="168.125.47.240"/>
      <filter dst_ip="203.43.145.112" proto="icmp" src_ip="168.125.47.240"/>
      <filter dst_ip="203.43.145.112" proto="tcp" src_ip="168.125.47.240"/>
      <filter dst_ip="203.43.145.112" proto="icmp" src_ip="168.125.47.240"/>
      <from sec="1041398633" usec="0"/>
      <to sec="1041398666" usec="0"/>
    </slice>
    <from sec="1041398633" usec="0"/>
    <to sec="1041398666" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="210.218.28.151" proto="tcp"/>
      <filter dst_ip="210.218.28.151" proto="icmp"/>
      <filter dst_ip="210.218.28.151" proto="tcp"/>
      <filter dst_ip="210.218.28.151" proto="icmp"/>
      <filter dst_ip="210.218.28.151" proto="tcp"/>
      <filter dst_ip="210.218.28.151" proto="icmp"/>
      <filter dst_ip="210.218.28.151" proto="tcp"/>
      <filter dst_ip="210.218.28.151" proto="icmp"/>
      <from sec="1041398468" usec="0"/>
      <to sec="1041398496" usec="0"/>
    </slice>
    <from sec="1041398468" usec="0"/>
    <to sec="1041398500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="217.128.45.202" proto="icmp"/>
      <filter dst_ip="217.128.45.202" proto="icmp"/>
      <filter dst_ip="217.128.45.202" proto="icmp"/>
      <filter dst_ip="217.128.45.202" proto="icmp"/>
      <from sec="1041398316" usec="0"/>
      <to sec="1041398355" usec="0"/>
    </slice>
    <from sec="1041398316" usec="0"/>
    <to sec="1041398359" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="61.93.47.217" proto="icmp"/>
      <filter dst_ip="61.93.47.217" proto="icmp"/>
      <filter dst_ip="61.93.47.217" proto="icmp"/>
      <filter dst_ip="61.93.47.217" proto="icmp"/>
      <from sec="1041397444" usec="0"/>
      <to sec="1041397451" usec="0"/>
    </slice>
    <from sec="1041397444" usec="0"/>
    <to sec="1041397453" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="88.125.209.255" proto="icmp"/>
      <filter dst_ip="88.125.209.255" proto="icmp"/>
      <filter dst_ip="88.125.209.255" proto="icmp"/>
      <filter dst_ip="88.125.209.255" proto="icmp"/>
      <from sec="1041397391" usec="0"/>
      <to sec="1041397415" usec="0"/>
    </slice>
    <from sec="1041397391" usec="0"/>
    <to sec="1041397415" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="209.169.98.24" proto="icmp"/>
      <filter dst_ip="209.169.98.24" proto="icmp"/>
      <filter dst_ip="209.169.98.24" proto="icmp"/>
      <filter dst_ip="209.169.98.24" proto="icmp"/>
      <from sec="1041397953" usec="0"/>
      <to sec="1041397963" usec="0"/>
    </slice>
    <from sec="1041397950" usec="0"/>
    <to sec="1041397963" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="200.170.26.192" proto="tcp"/>
      <filter dst_ip="200.170.26.192" proto="icmp"/>
      <filter dst_ip="200.170.26.192" proto="tcp"/>
      <filter dst_ip="200.170.26.192" proto="icmp"/>
      <filter dst_ip="200.170.26.192" proto="tcp"/>
      <filter dst_ip="200.170.26.192" proto="icmp"/>
      <filter dst_ip="200.170.26.192" proto="tcp"/>
      <filter dst_ip="200.170.26.192" proto="icmp"/>
      <from sec="1041398144" usec="0"/>
      <to sec="1041398166" usec="0"/>
    </slice>
    <from sec="1041398144" usec="0"/>
    <to sec="1041398173" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="61.137.167.5" proto="icmp"/>
      <filter dst_ip="61.137.167.5" proto="icmp"/>
      <filter dst_ip="61.137.167.5" proto="icmp"/>
      <filter dst_ip="61.137.167.5" proto="icmp"/>
      <from sec="1041397828" usec="0"/>
      <to sec="1041397856" usec="0"/>
    </slice>
    <from sec="1041397828" usec="0"/>
    <to sec="1041397856" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="91.27.23.21" proto="icmp"/>
      <filter dst_ip="91.27.23.21" proto="icmp"/>
      <filter dst_ip="91.27.23.21" proto="icmp"/>
      <filter dst_ip="91.27.23.21" proto="icmp"/>
      <from sec="1041397870" usec="0"/>
      <to sec="1041397888" usec="0"/>
    </slice>
    <from sec="1041397870" usec="0"/>
    <to sec="1041397888" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="217.70.12.132" proto="icmp"/>
      <filter dst_ip="217.70.12.132" proto="icmp"/>
      <filter dst_ip="217.70.12.132" proto="icmp"/>
      <filter dst_ip="217.70.12.132" proto="icmp"/>
      <from sec="1041398408" usec="0"/>
      <to sec="1041398435" usec="0"/>
    </slice>
    <from sec="1041398408" usec="0"/>
    <to sec="1041398435" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.550023,1.93176,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="152.12.27.158" proto="udp"/>
      <filter dst_ip="152.12.27.158" proto="icmp"/>
      <filter dst_ip="152.12.27.158" proto="udp"/>
      <filter dst_ip="152.12.27.158" proto="icmp"/>
      <filter dst_ip="152.12.27.158" proto="udp"/>
      <filter dst_ip="152.12.27.158" proto="icmp"/>
      <filter dst_ip="152.12.27.158" proto="udp"/>
      <filter dst_ip="152.12.27.158" proto="icmp"/>
      <from sec="1041398174" usec="0"/>
      <to sec="1041398181" usec="0"/>
    </slice>
    <from sec="1041398174" usec="0"/>
    <to sec="1041398190" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,503,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_104{
style=filled;
color=gray75;
6[label="217.85.129.8s;2pkt 2fpkt", shape=rectangle, color=red];
705[label="217.85.129.8s;2pkt 2fpkt", shape=ellipse, color=green];
1241[label="217.85.129.8s;2pkt 2fpkt", shape=triangle, color=blue];
stat104[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.58.81.8:80, 202.159.192.25:9234}[50%]&lt;BR/&gt;{208.58.81.8:80, 202.159.192.25:9235}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 9235: (25%)&lt;BR/&gt; 9234: (25%)&gt;];
}
6--705[label="1;2pkt 2fpkt"];
6--1241[label="1;2pkt 2fpkt"];
6--1655[label="1;2pkt 2fpkt"];
705--1241[label="1;2pkt 2fpkt"];
705--1655[label="1;2pkt 2fpkt"];
1241--1655[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="202.159.192.25" dst_port="9235" src_ip="208.58.81.8" src_port="80"/>
      <filter dst_ip="202.159.192.25" dst_port="9234" src_ip="208.58.81.8" src_port="80"/>
    </slice>
    <from sec="1041398359" usec="0"/>
    <to sec="1041398376" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.04191,1.81684,999,1 1 1 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_105{
style=filled;
color=gray75;
7[label="90.106.43.11s;3pkt 3fpkt", shape=rectangle, color=red];
706[label="90.106.43.11s;2pkt 2fpkt", shape=ellipse, color=green];
1242[label="90.106.43.11s;2pkt 2fpkt", shape=triangle, color=blue];
1631[label="90.106.43.11;s;25pkt 25fpkt", shape=diamond, color=yellow];
3371[label="90.106.43.11;25pkt 25fpkt", shape=pentagon, color=darkviolet];
4443[label="90.106.43.11;24pkt 24fpkt", shape=invtriangle, color=brown];
stat105[shape=component, label=&lt;Rules:&lt;BR/&gt;{90.106.43.11:6346, 148.155.246.77:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6346: (50%)&lt;BR/&gt; 2288: (3.7037%)&lt;BR/&gt; 2205: (3.7037%)&lt;BR/&gt; 2262: (2.46914%)&lt;BR/&gt; 2330: (1.85185%)&gt;];
}
7--706[label="1;2pkt 2fpkt"];
7--1242[label="1;2pkt 2fpkt"];
7--1628[label="1;3pkt 3fpkt"];
7--1631[label="1;3pkt 3fpkt"];
7--2726[label="1;3pkt 3fpkt"];
7--3213[label="1;3pkt 3fpkt"];
7--3371[label="1;3pkt 3fpkt"];
7--4443[label="1;3pkt 3fpkt"];
706--1242[label="1;2pkt 2fpkt"];
706--1628[label="1;2pkt 2fpkt"];
706--1631[label="1;2pkt 2fpkt"];
706--2726[label="1;2pkt 2fpkt"];
706--3213[label="1;2pkt 2fpkt"];
706--3371[label="1;2pkt 2fpkt"];
706--4443[label="1;2pkt 2fpkt"];
1242--1628[label="1;2pkt 2fpkt"];
1242--1631[label="1;2pkt 2fpkt"];
1242--2726[label="1;2pkt 2fpkt"];
1242--3213[label="1;2pkt 2fpkt"];
1242--3371[label="1;2pkt 2fpkt"];
1242--4443[label="1;2pkt 2fpkt"];
1631--2726[label="1;25pkt 25fpkt"];
1631--3213[label="1;25pkt 25fpkt"];
1631--3371[label="1;25pkt 25fpkt"];
1631--4443[label="1;24pkt 24fpkt"];
3371--4443[label="1;24pkt 24fpkt"];
</description>
    <slice>
      <filter dst_ip="148.155.246.77" src_ip="90.106.43.11" src_port="6346"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398309" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.620401,1.94046,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="172.142.200.59" dst_port="137" proto="tcp" src_ip="209.135.47.18" src_port="80"/>
      <filter dst_ip="172.142.200.59" dst_port="137" proto="udp" src_ip="209.135.47.18" src_port="80"/>
      <filter dst_ip="172.142.200.59" dst_port="137" proto="tcp" src_ip="209.135.47.18" src_port="1025"/>
      <filter dst_ip="172.142.200.59" dst_port="137" proto="udp" src_ip="209.135.47.18" src_port="1025"/>
      <from sec="1041397483" usec="0"/>
      <to sec="1041397499" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="172.142.200.59" dst_port="137" proto="tcp" src_ip="90.62.151.18" src_port="80"/>
      <filter dst_ip="172.142.200.59" dst_port="137" proto="udp" src_ip="90.62.151.18" src_port="80"/>
      <filter dst_ip="172.142.200.59" dst_port="137" proto="tcp" src_ip="90.62.151.18" src_port="1025"/>
      <filter dst_ip="172.142.200.59" dst_port="137" proto="udp" src_ip="90.62.151.18" src_port="1025"/>
      <from sec="1041397483" usec="0"/>
      <to sec="1041397499" usec="0"/>
    </slice>
    <from sec="1041397483" usec="0"/>
    <to sec="1041397499" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.17951,1.89871,999,1 1 1 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_107{
style=filled;
color=gray75;
11[label="136.234.119.19s;1pkt 1fpkt", shape=rectangle, color=red];
709[label="136.234.119.19s;1pkt 1fpkt", shape=ellipse, color=green];
1243[label="136.234.119.19s;1pkt 1fpkt", shape=triangle, color=blue];
1698[label="4.215.164.230;d;2pkt 2fpkt", shape=diamond, color=yellow];
2757[label="4.215.164.230;d;1pkt 1fpkt", shape=hexagon, color=black];
stat107[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.119.19:1412, 4.215.164.230:3031}[50%]&lt;BR/&gt;{136.234.119.19:1412, 4.215.164.230:3807}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1412: (50%)&lt;BR/&gt; 3031: (41.6667%)&lt;BR/&gt; 3807: (8.33333%)&gt;];
}
11--709[label="1;1pkt 1fpkt"];
11--1243[label="1;1pkt 1fpkt"];
11--1698[label="1;1pkt 1fpkt"];
11--1774[label="1;1pkt 1fpkt"];
11--2757[label="1;1pkt 1fpkt"];
11--2865[label="1;1pkt 1fpkt"];
709--1243[label="1;1pkt 1fpkt"];
709--1698[label="1;1pkt 1fpkt"];
709--1774[label="1;1pkt 1fpkt"];
709--2757[label="1;1pkt 1fpkt"];
709--2865[label="1;1pkt 1fpkt"];
1243--1698[label="1;1pkt 1fpkt"];
1243--1774[label="1;1pkt 1fpkt"];
1243--2757[label="1;1pkt 1fpkt"];
1243--2865[label="1;1pkt 1fpkt"];
1698--1774[label="0.5;1pkt 1fpkt"];
1698--2757[label="1;1pkt 1fpkt"];
1698--2865[label="0.5;1pkt 1fpkt"];
2757--2865[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="4.215.164.230" dst_port="3807" src_ip="136.234.119.19" src_port="1412"/>
      <filter dst_ip="4.215.164.230" dst_port="3031" src_ip="136.234.119.19" src_port="1412"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398782" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.18661,1.85795,999,1 1 1 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_109{
style=filled;
color=gray75;
17[label="165.205.205.26s;1pkt 1fpkt", shape=rectangle, color=red];
65[label="154.169.4.191s;1pkt 1fpkt", shape=rectangle, color=red];
713[label="23.79.221.26s;1pkt 1fpkt", shape=ellipse, color=green];
1247[label="23.79.221.26s;1pkt 1fpkt", shape=triangle, color=blue];
1778[label="148.155.247.29;d;252pkt 252fpkt", shape=diamond, color=yellow];
1781[label="4.147.177.127;s;1pkt 1fpkt", shape=diamond, color=yellow];
1831[label="165.205.205.26;s;2pkt 2fpkt", shape=diamond, color=yellow];
1980[label="154.169.4.191;s;1pkt 1fpkt", shape=diamond, color=yellow];
1987[label="219.171.157.48;s;1pkt 1fpkt", shape=diamond, color=yellow];
2314[label="209.122.47.243;s;1pkt 1fpkt", shape=diamond, color=yellow];
2885[label="165.205.205.26;s;2pkt 2fpkt", shape=hexagon, color=black];
3183[label="148.155.247.29;d;252pkt 252fpkt", shape=hexagon, color=black];
3188[label="154.169.4.191;s;1pkt 1fpkt", shape=hexagon, color=black];
3894[label="4.147.177.127;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat109[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:6257, 148.155.247.29:6257}[94.4444%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6257: (92.6641%)&lt;BR/&gt; 6970: (2.22008%)&lt;BR/&gt; 0: (1.1583%)&lt;BR/&gt; 6699: (0.675676%)&lt;BR/&gt; 3322: (0.675676%)&gt;];
}
17--713[label="1;1pkt 1fpkt"];
17--1247[label="1;1pkt 1fpkt"];
17--1778[label="1;1pkt 1fpkt"];
17--1831[label="1;1pkt 1fpkt"];
17--2885[label="1;1pkt 1fpkt"];
17--3183[label="1;1pkt 1fpkt"];
65--1778[label="1;1pkt 1fpkt"];
65--1980[label="1;1pkt 1fpkt"];
65--3183[label="1;1pkt 1fpkt"];
65--3188[label="1;1pkt 1fpkt"];
713--1247[label="1;1pkt 1fpkt"];
713--1778[label="1;1pkt 1fpkt"];
713--1831[label="1;1pkt 1fpkt"];
713--2885[label="1;1pkt 1fpkt"];
713--3183[label="1;1pkt 1fpkt"];
1247--1778[label="1;1pkt 1fpkt"];
1247--1831[label="1;1pkt 1fpkt"];
1247--2885[label="1;1pkt 1fpkt"];
1247--3183[label="1;1pkt 1fpkt"];
1778--1781[label="1;1pkt 1fpkt"];
1778--1828[label="1;1pkt 1fpkt"];
1778--1831[label="1;2pkt 2fpkt"];
1778--1980[label="1;1pkt 1fpkt"];
1778--1987[label="1;1pkt 1fpkt"];
1778--2314[label="1;1pkt 1fpkt"];
1778--2462[label="1;1pkt 1fpkt"];
1778--2885[label="1;2pkt 2fpkt"];
1778--3044[label="1;1pkt 1fpkt"];
1778--3048[label="1;1pkt 1fpkt"];
1778--3183[label="1;252pkt 252fpkt"];
1778--3188[label="1;1pkt 1fpkt"];
1778--3261[label="1;1pkt 1fpkt"];
1778--3277[label="0.111111;28pkt 28fpkt"];
1778--3281[label="0.464286;117pkt 117fpkt"];
1778--3286[label="0.166667;42pkt 42fpkt"];
1778--3291[label="0.111111;28pkt 28fpkt"];
1778--3300[label="0.111111;28pkt 28fpkt"];
1778--3894[label="1;1pkt 1fpkt"];
1781--3183[label="1;1pkt 1fpkt"];
1781--3894[label="1;1pkt 1fpkt"];
1831--2885[label="1;2pkt 2fpkt"];
1831--3183[label="1;2pkt 2fpkt"];
1831--3277[label="0.5;1pkt 1fpkt"];
1831--3281[label="0.5;1pkt 1fpkt"];
1831--3286[label="0.5;1pkt 1fpkt"];
1831--3291[label="0.5;1pkt 1fpkt"];
1831--3300[label="0.5;1pkt 1fpkt"];
1980--3183[label="1;1pkt 1fpkt"];
1980--3188[label="1;1pkt 1fpkt"];
1987--3183[label="1;1pkt 1fpkt"];
2314--3183[label="1;1pkt 1fpkt"];
2885--3183[label="1;2pkt 2fpkt"];
2885--3277[label="0.5;1pkt 1fpkt"];
2885--3281[label="0.5;1pkt 1fpkt"];
2885--3286[label="0.5;1pkt 1fpkt"];
2885--3291[label="0.5;1pkt 1fpkt"];
2885--3300[label="0.5;1pkt 1fpkt"];
3183--3188[label="1;1pkt 1fpkt"];
3183--3261[label="1;1pkt 1fpkt"];
3183--3277[label="0.111111;28pkt 28fpkt"];
3183--3281[label="0.464286;117pkt 117fpkt"];
3183--3286[label="0.166667;42pkt 42fpkt"];
3183--3291[label="0.111111;28pkt 28fpkt"];
3183--3300[label="0.111111;28pkt 28fpkt"];
3183--3894[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="148.155.247.29" dst_port="6257" src_port="6257"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.09123,1.91892,999,1 1 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_111{
style=filled;
color=gray75;
27[label="136.234.196.63s;1pkt 1fpkt", shape=rectangle, color=red];
720[label="136.234.196.63s;1pkt 1fpkt", shape=ellipse, color=green];
1653[label="136.234.196.63;s;1471pkt 1471fpkt", shape=diamond, color=yellow];
1777[label="93.134.150.221;d;1pkt 1fpkt", shape=diamond, color=yellow];
1816[label="4.11.21.2;d;1pkt 1fpkt", shape=diamond, color=yellow];
1895[label="193.116.247.47;d;2pkt 2fpkt", shape=diamond, color=yellow];
2075[label="71.168.131.61;d;1pkt 1fpkt", shape=diamond, color=yellow];
2146[label="63.64.242.55;d;1pkt 1fpkt", shape=diamond, color=yellow];
2311[label="90.135.9.3;d;2pkt 2fpkt", shape=diamond, color=yellow];
2554[label="62.165.32.52;d;2pkt 2fpkt", shape=diamond, color=yellow];
2557[label="200.224.215.140;d;2pkt 2fpkt", shape=diamond, color=yellow];
2575[label="70.73.43.163;d;1pkt 1fpkt", shape=diamond, color=yellow];
2945[label="193.116.247.47;d;2pkt 2fpkt", shape=hexagon, color=black];
stat111[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.196.63:6257, *:6257}[97.1448%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6257: (97.211%)&lt;BR/&gt; 6699: (0.974462%)&lt;BR/&gt; 1575: (0.134409%)&lt;BR/&gt; 6250: (0.100806%)&lt;BR/&gt; 3233: (0.100806%)&gt;];
}
27--720[label="1;1pkt 1fpkt"];
27--1653[label="1;1pkt 1fpkt"];
27--2554[label="1;1pkt 1fpkt"];
720--1653[label="1;1pkt 1fpkt"];
720--2554[label="1;1pkt 1fpkt"];
1653--1777[label="1;1pkt 1fpkt"];
1653--1788[label="1;1pkt 1fpkt"];
1653--1816[label="1;1pkt 1fpkt"];
1653--1837[label="1;1pkt 1fpkt"];
1653--1895[label="1;2pkt 2fpkt"];
1653--2075[label="1;1pkt 1fpkt"];
1653--2146[label="1;1pkt 1fpkt"];
1653--2287[label="0.5;1pkt 1fpkt"];
1653--2311[label="1;2pkt 2fpkt"];
1653--2317[label="1;1pkt 1fpkt"];
1653--2532[label="1;1pkt 1fpkt"];
1653--2554[label="1;2pkt 2fpkt"];
1653--2557[label="1;2pkt 2fpkt"];
1653--2575[label="1;1pkt 1fpkt"];
1653--2765[label="1;1pkt 1fpkt"];
1653--2945[label="1;2pkt 2fpkt"];
1653--3091[label="1;1pkt 1fpkt"];
1653--3115[label="1;1pkt 1fpkt"];
1653--3185[label="1;1pkt 1fpkt"];
1653--3277[label="0.114137;88pkt 88fpkt"];
1653--3281[label="0.289599;426pkt 426fpkt"];
1653--3286[label="0.12043;168pkt 168fpkt"];
1653--3291[label="0.114137;88pkt 88fpkt"];
1653--3300[label="0.114137;88pkt 88fpkt"];
1895--2945[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_port="6257" src_ip="136.234.196.63" src_port="6257"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_112{
style=filled;
color=gray75;
30[label="61.206.135.75s;251pkt 251fpkt", shape=rectangle, color=red];
721[label="61.206.135.75s;251pkt 251fpkt", shape=ellipse, color=green];
1251[label="61.206.135.75s;251pkt 251fpkt", shape=triangle, color=blue];
stat112[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.206.135.75:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
30--721[label="1;251pkt 251fpkt"];
30--1251[label="1;251pkt 251fpkt"];
721--1251[label="1;251pkt 251fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.206.135.75" src_port="1026"/>
    </slice>
    <from sec="1041397314" usec="0"/>
    <to sec="1041397341" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.17951,1.89871,999,1 1 1 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_114{
style=filled;
color=gray75;
41[label="61.240.190.109s;1pkt 1fpkt", shape=rectangle, color=red];
730[label="61.240.190.109s;1pkt 1fpkt", shape=ellipse, color=green];
1257[label="61.240.190.109s;1pkt 1fpkt", shape=triangle, color=blue];
1828[label="175.45.110.109;s;1pkt 1fpkt", shape=diamond, color=yellow];
3044[label="175.45.110.109;s;1pkt 1fpkt", shape=hexagon, color=black];
stat114[shape=component, label=&lt;Rules:&lt;BR/&gt;{175.45.110.109:4287, 148.155.247.29:6970}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6970: (50%)&lt;BR/&gt; 4287: (50%)&gt;];
}
41--730[label="1;1pkt 1fpkt"];
41--1257[label="1;1pkt 1fpkt"];
41--1778[label="1;1pkt 1fpkt"];
41--1828[label="1;1pkt 1fpkt"];
41--3044[label="1;1pkt 1fpkt"];
41--3183[label="1;1pkt 1fpkt"];
730--1257[label="1;1pkt 1fpkt"];
730--1778[label="1;1pkt 1fpkt"];
730--1828[label="1;1pkt 1fpkt"];
730--3044[label="1;1pkt 1fpkt"];
730--3183[label="1;1pkt 1fpkt"];
1257--1778[label="1;1pkt 1fpkt"];
1257--1828[label="1;1pkt 1fpkt"];
1257--3044[label="1;1pkt 1fpkt"];
1257--3183[label="1;1pkt 1fpkt"];
1828--3044[label="1;1pkt 1fpkt"];
1828--3183[label="1;1pkt 1fpkt"];
3044--3183[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="148.155.247.29" dst_port="6970" src_ip="175.45.110.109" src_port="4287"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.759727,1.88301,503,1 1 0 0 0 0 0 0 0 0 1 0 ">
    <description>subgraph cluster_115{
style=filled;
color=gray75;
44[label="212.2.80.115s;1pkt 1fpkt", shape=rectangle, color=red];
731[label="212.2.80.115s;1pkt 1fpkt", shape=ellipse, color=green];
4688[label="212.2.80.115;3pkt 3fpkt", shape=invtriangle, color=brown];
stat115[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.2.80.115:45291, 148.155.61.104:80}[33.3333%]&lt;BR/&gt;{212.2.80.115:45429, 148.155.61.104:80}[33.3333%]&lt;BR/&gt;{212.2.80.115:46211, 148.155.61.104:80}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 46211: (30%)&lt;BR/&gt; 45429: (10%)&lt;BR/&gt; 45291: (10%)&gt;];
}
44--731[label="1;1pkt 1fpkt"];
44--3284[label="1;1pkt 1fpkt"];
44--4688[label="1;1pkt 1fpkt"];
731--3284[label="1;1pkt 1fpkt"];
731--4688[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="148.155.61.104" dst_port="80" src_ip="212.2.80.115" src_port="46211"/>
      <filter dst_ip="148.155.61.104" dst_port="80" src_ip="212.2.80.115" src_port="45429"/>
      <filter dst_ip="148.155.61.104" dst_port="80" src_ip="212.2.80.115" src_port="45291"/>
    </slice>
    <from sec="1041398716" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_116{
style=filled;
color=gray75;
331[label="210.153.29.117s;405pkt 405fpkt", shape=rectangle, color=red];
732[label="210.153.29.117s;390pkt 390fpkt", shape=ellipse, color=green];
1419[label="210.153.29.117s;298pkt 298fpkt", shape=triangle, color=blue];
stat116[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.153.29.117:1028, *:137}[53.3333%]&lt;BR/&gt;{210.153.29.117:1026, *:137}[46.6667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 1028: (28.2708%)&lt;BR/&gt; 1026: (21.7292%)&gt;];
}
331--732[label="1;390pkt 390fpkt"];
331--1419[label="1;298pkt 298fpkt"];
331--3276[label="0.466667;189pkt 189fpkt"];
331--3290[label="0.466667;189pkt 189fpkt"];
331--3299[label="0.466667;189pkt 189fpkt"];
732--1419[label="1;298pkt 298fpkt"];
732--3276[label="0.484615;189pkt 189fpkt"];
732--3290[label="0.484615;189pkt 189fpkt"];
732--3299[label="0.484615;189pkt 189fpkt"];
1419--3276[label="0.325503;97pkt 97fpkt"];
1419--3290[label="0.325503;97pkt 97fpkt"];
1419--3299[label="0.325503;97pkt 97fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="210.153.29.117" src_port="1028"/>
      <filter dst_port="137" src_ip="210.153.29.117" src_port="1026"/>
    </slice>
    <from sec="1041397201" usec="0"/>
    <to sec="1041397475" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.770694,1.8419,503,1 1 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_117{
style=filled;
color=gray75;
47[label="88.177.0.129s;1pkt 1fpkt", shape=rectangle, color=red];
733[label="88.177.0.129s;1pkt 1fpkt", shape=ellipse, color=green];
3904[label="88.177.0.129;17pkt 17fpkt", shape=pentagon, color=darkviolet];
4722[label="88.177.0.129;17pkt 17fpkt", shape=invtriangle, color=brown];
stat117[shape=component, label=&lt;Rules:&lt;BR/&gt;{88.177.0.129:80, 202.159.192.25:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 31475: (5.55556%)&lt;BR/&gt; 32234: (2.77778%)&lt;BR/&gt; 32203: (2.77778%)&lt;BR/&gt; 32186: (2.77778%)&gt;];
}
47--733[label="1;1pkt 1fpkt"];
47--1655[label="1;1pkt 1fpkt"];
47--3904[label="1;1pkt 1fpkt"];
47--4722[label="1;1pkt 1fpkt"];
733--1655[label="1;1pkt 1fpkt"];
733--3904[label="1;1pkt 1fpkt"];
733--4722[label="1;1pkt 1fpkt"];
3904--4722[label="1;17pkt 17fpkt"];
</description>
    <slice>
      <filter dst_ip="202.159.192.25" src_ip="88.177.0.129" src_port="80"/>
    </slice>
    <from sec="1041397436" usec="0"/>
    <to sec="1041397557" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.25055,1.88245,999,1 1 1 1 1 0 0 0 0 0 1 0 ">
    <description>subgraph cluster_118{
style=filled;
color=gray75;
49[label="62.143.229.133s;2pkt 2fpkt", shape=rectangle, color=red];
735[label="62.143.229.133s;2pkt 2fpkt", shape=ellipse, color=green];
1258[label="62.143.229.133s;2pkt 2fpkt", shape=triangle, color=blue];
1855[label="212.176.153.133;s;1pkt 1fpkt", shape=diamond, color=yellow];
1929[label="90.27.221.133;s;1pkt 1fpkt", shape=diamond, color=yellow];
3077[label="90.27.221.133;s;1pkt 1fpkt", shape=hexagon, color=black];
4742[label="90.27.221.133;1pkt 1fpkt", shape=invtriangle, color=brown];
stat118[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.176.153.133:412, 168.125.205.3:4013}[50%]&lt;BR/&gt;{90.27.221.133:1154, 136.234.119.19:1412}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1412: (30%)&lt;BR/&gt; 1154: (30%)&lt;BR/&gt; 4013: (20%)&lt;BR/&gt; 412: (20%)&gt;];
}
49--735[label="1;2pkt 2fpkt"];
49--1258[label="1;2pkt 2fpkt"];
49--1616[label="0.5;1pkt 1fpkt"];
49--1855[label="1;1pkt 1fpkt"];
49--1891[label="0.5;1pkt 1fpkt"];
49--1929[label="1;1pkt 1fpkt"];
49--2772[label="0.5;1pkt 1fpkt"];
49--2963[label="0.5;1pkt 1fpkt"];
49--3077[label="1;1pkt 1fpkt"];
49--3238[label="0.5;1pkt 1fpkt"];
49--3250[label="0.5;1pkt 1fpkt"];
49--4742[label="1;1pkt 1fpkt"];
735--1258[label="1;2pkt 2fpkt"];
735--1616[label="0.5;1pkt 1fpkt"];
735--1855[label="1;1pkt 1fpkt"];
735--1891[label="0.5;1pkt 1fpkt"];
735--1929[label="1;1pkt 1fpkt"];
735--2772[label="0.5;1pkt 1fpkt"];
735--2963[label="0.5;1pkt 1fpkt"];
735--3077[label="1;1pkt 1fpkt"];
735--3238[label="0.5;1pkt 1fpkt"];
735--3250[label="0.5;1pkt 1fpkt"];
735--4742[label="1;1pkt 1fpkt"];
1258--1616[label="0.5;1pkt 1fpkt"];
1258--1855[label="1;1pkt 1fpkt"];
1258--1891[label="0.5;1pkt 1fpkt"];
1258--1929[label="1;1pkt 1fpkt"];
1258--2772[label="0.5;1pkt 1fpkt"];
1258--2963[label="0.5;1pkt 1fpkt"];
1258--3077[label="1;1pkt 1fpkt"];
1258--3238[label="0.5;1pkt 1fpkt"];
1258--3250[label="0.5;1pkt 1fpkt"];
1258--4742[label="1;1pkt 1fpkt"];
1855--1891[label="1;1pkt 1fpkt"];
1855--2963[label="1;1pkt 1fpkt"];
1855--3250[label="1;1pkt 1fpkt"];
1929--2772[label="1;1pkt 1fpkt"];
1929--3077[label="1;1pkt 1fpkt"];
1929--3238[label="1;1pkt 1fpkt"];
1929--4742[label="1;1pkt 1fpkt"];
3077--3238[label="1;1pkt 1fpkt"];
3077--4742[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="136.234.119.19" dst_port="1412" src_ip="90.27.221.133" src_port="1154"/>
      <filter dst_ip="168.125.205.3" dst_port="4013" src_ip="212.176.153.133" src_port="412"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.620401,1.94046,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="197.90.54.66" dst_port="137" proto="tcp" src_ip="61.226.36.138" src_port="1026"/>
      <filter dst_ip="197.90.54.66" dst_port="137" proto="udp" src_ip="61.226.36.138" src_port="1026"/>
      <filter dst_ip="197.90.54.66" dst_port="80" proto="tcp" src_ip="61.226.36.138" src_port="1026"/>
      <filter dst_ip="197.90.54.66" dst_port="80" proto="udp" src_ip="61.226.36.138" src_port="1026"/>
      <from sec="1041397468" usec="0"/>
      <to sec="1041397496" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="197.90.54.66" dst_port="137" proto="tcp" src_ip="144.52.72.113" src_port="1026"/>
      <filter dst_ip="197.90.54.66" dst_port="137" proto="udp" src_ip="144.52.72.113" src_port="1026"/>
      <filter dst_ip="197.90.54.66" dst_port="80" proto="tcp" src_ip="144.52.72.113" src_port="1026"/>
      <filter dst_ip="197.90.54.66" dst_port="80" proto="udp" src_ip="144.52.72.113" src_port="1026"/>
      <from sec="1041397480" usec="0"/>
      <to sec="1041397489" usec="0"/>
    </slice>
    <from sec="1041397468" usec="0"/>
    <to sec="1041397498" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,503,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_120{
style=filled;
color=gray75;
57[label="88.212.112.154s;1pkt 1fpkt", shape=rectangle, color=red];
737[label="88.212.112.154s;1pkt 1fpkt", shape=ellipse, color=green];
1468[label="90.38.140.154s;1pkt 1fpkt", shape=triangle, color=blue];
stat120[shape=component, label=&lt;Rules:&lt;BR/&gt;{88.212.112.154:14730, 172.142.195.215:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 14730: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
57--737[label="1;1pkt 1fpkt"];
57--1468[label="1;1pkt 1fpkt"];
57--2186[label="1;1pkt 1fpkt"];
737--1468[label="1;1pkt 1fpkt"];
737--2186[label="1;1pkt 1fpkt"];
1468--2186[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="172.142.195.215" dst_port="80" src_ip="88.212.112.154" src_port="14730"/>
    </slice>
    <from sec="1041398549" usec="0"/>
    <to sec="1041398583" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,999,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_121{
style=filled;
color=gray75;
60[label="4.111.64.165s;2pkt 2fpkt", shape=rectangle, color=red];
739[label="4.111.64.165s;2pkt 2fpkt", shape=ellipse, color=green];
1261[label="4.111.64.165s;2pkt 2fpkt", shape=triangle, color=blue];
stat121[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.111.64.165:8288, 148.155.246.77:2526}[50%]&lt;BR/&gt;{4.111.64.165:8288, 148.155.246.77:2534}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8288: (50%)&lt;BR/&gt; 2534: (25%)&lt;BR/&gt; 2526: (25%)&gt;];
}
60--739[label="1;2pkt 2fpkt"];
60--1261[label="1;2pkt 2fpkt"];
739--1261[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="148.155.246.77" dst_port="2534" src_ip="4.111.64.165" src_port="8288"/>
      <filter dst_ip="148.155.246.77" dst_port="2526" src_ip="4.111.64.165" src_port="8288"/>
    </slice>
    <from sec="1041398782" usec="0"/>
    <to sec="1041398819" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.834096,1.89544,999,1 1 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_122{
style=filled;
color=gray75;
66[label="93.182.225.196s;1pkt 1fpkt", shape=rectangle, color=red];
741[label="93.182.225.196s;1pkt 1fpkt", shape=ellipse, color=green];
2614[label="93.182.225.196;s;2pkt 2fpkt", shape=diamond, color=yellow];
stat122[shape=component, label=&lt;Rules:&lt;BR/&gt;{93.182.225.196:3751, 203.11.225.28:5548}[50%]&lt;BR/&gt;{93.182.225.196:3756, 203.11.225.28:5548}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5548: (50%)&lt;BR/&gt; 3751: (37.5%)&lt;BR/&gt; 3756: (12.5%)&gt;];
}
66--741[label="1;1pkt 1fpkt"];
66--2071[label="1;1pkt 1fpkt"];
66--2614[label="1;1pkt 1fpkt"];
66--2934[label="1;1pkt 1fpkt"];
741--2071[label="1;1pkt 1fpkt"];
741--2614[label="1;1pkt 1fpkt"];
741--2934[label="1;1pkt 1fpkt"];
2614--2934[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="203.11.225.28" dst_port="5548" src_ip="93.182.225.196" src_port="3756"/>
      <filter dst_ip="203.11.225.28" dst_port="5548" src_ip="93.182.225.196" src_port="3751"/>
    </slice>
    <from sec="1041398419" usec="0"/>
    <to sec="1041398658" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_124{
style=filled;
color=gray75;
78[label="217.72.161.252s;254pkt 254fpkt", shape=rectangle, color=red];
747[label="217.72.161.252s;254pkt 254fpkt", shape=ellipse, color=green];
1267[label="217.72.161.252s;204pkt 204fpkt", shape=triangle, color=blue];
4391[label="217.72.161.252;254pkt 254fpkt", shape=pentagon, color=darkviolet];
4985[label="217.72.161.252;254pkt 254fpkt", shape=invtriangle, color=brown];
stat124[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.72.161.252:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
78--747[label="1;254pkt 254fpkt"];
78--1267[label="1;204pkt 204fpkt"];
78--4391[label="1;254pkt 254fpkt"];
78--4985[label="1;254pkt 254fpkt"];
747--1267[label="1;204pkt 204fpkt"];
747--4391[label="1;254pkt 254fpkt"];
747--4985[label="1;254pkt 254fpkt"];
1267--4391[label="1;204pkt 204fpkt"];
1267--4985[label="1;204pkt 204fpkt"];
4391--4985[label="1;254pkt 254fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.72.161.252" src_port="1028"/>
    </slice>
    <from sec="1041397373" usec="0"/>
    <to sec="1041397413" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,503,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_125{
style=filled;
color=gray75;
79[label="202.159.192.25d;1pkt 1fpkt", shape=rectangle, color=red];
748[label="202.159.192.25d;1pkt 1fpkt", shape=ellipse, color=green];
stat125[shape=component, label=&lt;Rules:&lt;BR/&gt;{89.16.249.122:80, 202.159.192.25:13189}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 13189: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
79--748[label="1;1pkt 1fpkt"];
79--1655[label="1;1pkt 1fpkt"];
748--1655[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="202.159.192.25" dst_port="13189" src_ip="89.16.249.122" src_port="80"/>
    </slice>
    <from sec="1041398732" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.02037,1.88019,002,1 1 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_127{
style=filled;
color=gray75;
93[label="216.84.144.1s;131pkt 131fpkt", shape=rectangle, color=red];
757[label="216.84.144.1s;95pkt 95fpkt", shape=ellipse, color=green];
3311[label="216.84.144.1;151pkt 151fpkt", shape=pentagon, color=darkviolet];
4409[label="216.84.144.1;150pkt 150fpkt", shape=invtriangle, color=brown];
4994[label="216.84.144.1;151pkt 151fpkt", shape=invhouse, color=bisque];
stat127[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.84.144.1:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
93--757[label="1;95pkt 95fpkt"];
93--3311[label="1;131pkt 131fpkt"];
93--4409[label="0.992366;130pkt 130fpkt"];
93--4994[label="1;131pkt 131fpkt"];
757--3311[label="1;95pkt 95fpkt"];
757--4409[label="0.989474;94pkt 94fpkt"];
757--4994[label="1;95pkt 95fpkt"];
3311--4409[label="1;150pkt 150fpkt"];
3311--4994[label="1;151pkt 151fpkt"];
4409--4994[label="1;150pkt 150fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="216.84.144.1" src_port="1025"/>
    </slice>
    <from sec="1041397945" usec="0"/>
    <to sec="1041397973" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_128{
style=filled;
color=gray75;
94[label="209.158.174.1s;99pkt 99fpkt", shape=rectangle, color=red];
758[label="209.158.174.1s;75pkt 75fpkt", shape=ellipse, color=green];
stat128[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.158.174.1:37309, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 37309: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
94--758[label="1;75pkt 75fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="209.158.174.1" src_port="37309"/>
    </slice>
    <from sec="1041397571" usec="0"/>
    <to sec="1041397587" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_129{
style=filled;
color=gray75;
96[label="61.141.208.1s;205pkt 205fpkt", shape=rectangle, color=red];
760[label="61.141.208.1s;158pkt 158fpkt", shape=ellipse, color=green];
1275[label="61.141.208.1s;158pkt 158fpkt", shape=triangle, color=blue];
3313[label="61.141.208.1;219pkt 219fpkt", shape=pentagon, color=darkviolet];
stat129[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.141.208.1:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
96--760[label="1;158pkt 158fpkt"];
96--1275[label="1;158pkt 158fpkt"];
96--3313[label="1;205pkt 205fpkt"];
760--1275[label="1;158pkt 158fpkt"];
760--3313[label="1;158pkt 158fpkt"];
1275--3313[label="1;158pkt 158fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.141.208.1" src_port="1026"/>
    </slice>
    <from sec="1041398311" usec="0"/>
    <to sec="1041398359" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_130{
style=filled;
color=gray75;
99[label="88.35.65.2s;243pkt 243fpkt", shape=rectangle, color=red];
762[label="88.35.65.2s;243pkt 243fpkt", shape=ellipse, color=green];
1277[label="88.35.65.2s;158pkt 158fpkt", shape=triangle, color=blue];
3316[label="88.35.65.2;243pkt 243fpkt", shape=pentagon, color=darkviolet];
stat130[shape=component, label=&lt;Rules:&lt;BR/&gt;{88.35.65.2:64447, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 64447: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
99--762[label="1;243pkt 243fpkt"];
99--1277[label="1;158pkt 158fpkt"];
99--3316[label="1;243pkt 243fpkt"];
762--1277[label="1;158pkt 158fpkt"];
762--3316[label="1;243pkt 243fpkt"];
1277--3316[label="1;158pkt 158fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="88.35.65.2" src_port="64447"/>
    </slice>
    <from sec="1041398206" usec="0"/>
    <to sec="1041398250" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_131{
style=filled;
color=gray75;
103[label="4.69.139.4s;57pkt 57fpkt", shape=rectangle, color=red];
765[label="4.69.139.4s;57pkt 57fpkt", shape=ellipse, color=green];
stat131[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.69.139.4:1074, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1074: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
103--765[label="1;57pkt 57fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="4.69.139.4" src_port="1074"/>
    </slice>
    <from sec="1041398192" usec="0"/>
    <to sec="1041398205" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_132{
style=filled;
color=gray75;
104[label="217.46.161.4s;214pkt 214fpkt", shape=rectangle, color=red];
766[label="217.46.161.4s;214pkt 214fpkt", shape=ellipse, color=green];
1279[label="217.46.161.4s;129pkt 129fpkt", shape=triangle, color=blue];
3332[label="217.46.161.4;214pkt 214fpkt", shape=pentagon, color=darkviolet];
4418[label="217.46.161.4;214pkt 214fpkt", shape=invtriangle, color=brown];
stat132[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.46.161.4:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
104--766[label="1;214pkt 214fpkt"];
104--1279[label="1;129pkt 129fpkt"];
104--3332[label="1;214pkt 214fpkt"];
104--4418[label="1;214pkt 214fpkt"];
766--1279[label="1;129pkt 129fpkt"];
766--3332[label="1;214pkt 214fpkt"];
766--4418[label="1;214pkt 214fpkt"];
1279--3332[label="1;129pkt 129fpkt"];
1279--4418[label="1;129pkt 129fpkt"];
3332--4418[label="1;214pkt 214fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.46.161.4" src_port="1025"/>
    </slice>
    <from sec="1041397813" usec="0"/>
    <to sec="1041397848" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.17951,1.89871,999,1 1 1 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_133{
style=filled;
color=gray75;
3[label="89.2.40.5s;1pkt 1fpkt", shape=rectangle, color=red];
107[label="217.60.68.5s;1pkt 1fpkt", shape=rectangle, color=red];
767[label="89.2.40.5s;1pkt 1fpkt", shape=ellipse, color=green];
768[label="217.60.68.5s;1pkt 1fpkt", shape=ellipse, color=green];
1280[label="89.2.40.5s;1pkt 1fpkt", shape=triangle, color=blue];
1281[label="217.60.68.5s;1pkt 1fpkt", shape=triangle, color=blue];
1986[label="90.107.31.40;d;1pkt 1fpkt", shape=diamond, color=yellow];
2058[label="148.155.168.5;s;4pkt 4fpkt", shape=diamond, color=yellow];
2887[label="148.155.168.5;s;4pkt 4fpkt", shape=hexagon, color=black];
stat133[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.155.168.5:26012, 90.107.31.40:6699}[25%]&lt;BR/&gt;{148.155.168.5:25999, 205.65.18.44:1863}[25%]&lt;BR/&gt;{148.155.168.5:26150, 204.250.33.87:6699}[25%]&lt;BR/&gt;{148.155.168.5:26151, 204.250.33.87:6699}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (43.3333%)&lt;BR/&gt; 26012: (30%)&lt;BR/&gt; 26151: (6.66667%)&lt;BR/&gt; 26150: (6.66667%)&lt;BR/&gt; 25999: (6.66667%)&gt;];
}
3--107[label="1;1pkt 1fpkt"];
3--767[label="1;1pkt 1fpkt"];
3--768[label="1;1pkt 1fpkt"];
3--1280[label="1;1pkt 1fpkt"];
3--1281[label="1;1pkt 1fpkt"];
3--1986[label="1;1pkt 1fpkt"];
3--2058[label="1;1pkt 1fpkt"];
3--2887[label="1;1pkt 1fpkt"];
107--767[label="1;1pkt 1fpkt"];
107--768[label="1;1pkt 1fpkt"];
107--1280[label="1;1pkt 1fpkt"];
107--1281[label="1;1pkt 1fpkt"];
107--1986[label="1;1pkt 1fpkt"];
107--2058[label="1;1pkt 1fpkt"];
107--2887[label="1;1pkt 1fpkt"];
767--768[label="1;1pkt 1fpkt"];
767--1280[label="1;1pkt 1fpkt"];
767--1281[label="1;1pkt 1fpkt"];
767--1986[label="1;1pkt 1fpkt"];
767--2058[label="1;1pkt 1fpkt"];
767--2887[label="1;1pkt 1fpkt"];
768--1280[label="1;1pkt 1fpkt"];
768--1281[label="1;1pkt 1fpkt"];
768--1986[label="1;1pkt 1fpkt"];
768--2058[label="1;1pkt 1fpkt"];
768--2887[label="1;1pkt 1fpkt"];
1280--1281[label="1;1pkt 1fpkt"];
1280--1986[label="1;1pkt 1fpkt"];
1280--2058[label="1;1pkt 1fpkt"];
1280--2887[label="1;1pkt 1fpkt"];
1281--1986[label="1;1pkt 1fpkt"];
1281--2058[label="1;1pkt 1fpkt"];
1281--2887[label="1;1pkt 1fpkt"];
1986--2058[label="1;1pkt 1fpkt"];
1986--2887[label="1;1pkt 1fpkt"];
2058--2887[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="204.250.33.87" dst_port="6699" src_ip="148.155.168.5" src_port="26151"/>
      <filter dst_ip="204.250.33.87" dst_port="6699" src_ip="148.155.168.5" src_port="26150"/>
      <filter dst_ip="205.65.18.44" dst_port="1863" src_ip="148.155.168.5" src_port="25999"/>
      <filter dst_ip="90.107.31.40" dst_port="6699" src_ip="148.155.168.5" src_port="26012"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_134{
style=filled;
color=gray75;
110[label="217.19.82.6s;246pkt 246fpkt", shape=rectangle, color=red];
769[label="217.19.82.6s;136pkt 136fpkt", shape=ellipse, color=green];
stat134[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.19.82.6:21124, *:137}[71.9512%]&lt;BR/&gt;{217.19.82.6:1132, *:137}[28.0488%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 21124: (31.9372%)&lt;BR/&gt; 1132: (18.0628%)&gt;];
}
110--769[label="1;136pkt 136fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.19.82.6" src_port="21124"/>
      <filter dst_port="137" src_ip="217.19.82.6" src_port="1132"/>
    </slice>
    <from sec="1041397809" usec="0"/>
    <to sec="1041398532" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_135{
style=filled;
color=gray75;
112[label="92.20.24.7s;137pkt 137fpkt", shape=rectangle, color=red];
771[label="92.20.24.7s;137pkt 137fpkt", shape=ellipse, color=green];
1283[label="92.20.24.7s;72pkt 72fpkt", shape=triangle, color=blue];
3350[label="92.20.24.7;137pkt 137fpkt", shape=pentagon, color=darkviolet];
stat135[shape=component, label=&lt;Rules:&lt;BR/&gt;{92.20.24.7:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
112--771[label="1;137pkt 137fpkt"];
112--1283[label="1;72pkt 72fpkt"];
112--3350[label="1;137pkt 137fpkt"];
771--1283[label="1;72pkt 72fpkt"];
771--3350[label="1;137pkt 137fpkt"];
1283--3350[label="1;72pkt 72fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="92.20.24.7" src_port="1027"/>
    </slice>
    <from sec="1041397390" usec="0"/>
    <to sec="1041397413" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_136{
style=filled;
color=gray75;
113[label="217.132.50.7s;109pkt 109fpkt", shape=rectangle, color=red];
772[label="217.132.50.7s;109pkt 109fpkt", shape=ellipse, color=green];
1284[label="217.132.50.7s;109pkt 109fpkt", shape=triangle, color=blue];
3351[label="217.132.50.7;148pkt 148fpkt", shape=pentagon, color=darkviolet];
4428[label="217.132.50.7;147pkt 147fpkt", shape=invtriangle, color=brown];
5000[label="217.132.50.7;148pkt 148fpkt", shape=invhouse, color=bisque];
stat136[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.132.50.7:1030, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1030: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
113--772[label="1;109pkt 109fpkt"];
113--1284[label="1;109pkt 109fpkt"];
113--3351[label="1;109pkt 109fpkt"];
113--4428[label="1;109pkt 109fpkt"];
113--5000[label="1;109pkt 109fpkt"];
772--1284[label="1;109pkt 109fpkt"];
772--3351[label="1;109pkt 109fpkt"];
772--4428[label="1;109pkt 109fpkt"];
772--5000[label="1;109pkt 109fpkt"];
1284--3351[label="1;109pkt 109fpkt"];
1284--4428[label="1;109pkt 109fpkt"];
1284--5000[label="1;109pkt 109fpkt"];
3351--4428[label="1;147pkt 147fpkt"];
3351--5000[label="1;148pkt 148fpkt"];
4428--5000[label="1;147pkt 147fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.132.50.7" src_port="1030"/>
    </slice>
    <from sec="1041398706" usec="0"/>
    <to sec="1041398731" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_137{
style=filled;
color=gray75;
114[label="149.120.64.7s;255pkt 255fpkt", shape=rectangle, color=red];
773[label="149.120.64.7s;190pkt 190fpkt", shape=ellipse, color=green];
1285[label="149.120.64.7s;90pkt 90fpkt", shape=triangle, color=blue];
stat137[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.120.64.7:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
114--773[label="1;190pkt 190fpkt"];
114--1285[label="1;90pkt 90fpkt"];
773--1285[label="1;90pkt 90fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="149.120.64.7" src_port="1027"/>
    </slice>
    <from sec="1041397595" usec="0"/>
    <to sec="1041397634" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_138{
style=filled;
color=gray75;
117[label="88.112.135.9s;185pkt 185fpkt", shape=rectangle, color=red];
776[label="88.112.135.9s;185pkt 185fpkt", shape=ellipse, color=green];
1288[label="88.112.135.9s;179pkt 179fpkt", shape=triangle, color=blue];
stat138[shape=component, label=&lt;Rules:&lt;BR/&gt;{88.112.135.9:1031, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1031: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
117--776[label="1;185pkt 185fpkt"];
117--1288[label="1;179pkt 179fpkt"];
776--1288[label="1;179pkt 179fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="88.112.135.9" src_port="1031"/>
    </slice>
    <from sec="1041398265" usec="0"/>
    <to sec="1041398298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_139{
style=filled;
color=gray75;
120[label="61.243.88.10s;235pkt 235fpkt", shape=rectangle, color=red];
778[label="61.243.88.10s;212pkt 212fpkt", shape=ellipse, color=green];
1290[label="61.243.88.10s;212pkt 212fpkt", shape=triangle, color=blue];
stat139[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.243.88.10:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
120--778[label="1;212pkt 212fpkt"];
120--1290[label="1;212pkt 212fpkt"];
778--1290[label="1;212pkt 212fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.243.88.10" src_port="1026"/>
    </slice>
    <from sec="1041398376" usec="0"/>
    <to sec="1041398419" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_140{
style=filled;
color=gray75;
121[label="89.82.193.10s;256pkt 256fpkt", shape=rectangle, color=red];
779[label="89.82.193.10s;256pkt 256fpkt", shape=ellipse, color=green];
1291[label="89.82.193.10s;256pkt 256fpkt", shape=triangle, color=blue];
3369[label="89.82.193.10;256pkt 256fpkt", shape=pentagon, color=darkviolet];
stat140[shape=component, label=&lt;Rules:&lt;BR/&gt;{89.82.193.10:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
121--779[label="1;256pkt 256fpkt"];
121--1291[label="1;256pkt 256fpkt"];
121--3369[label="1;256pkt 256fpkt"];
779--1291[label="1;256pkt 256fpkt"];
779--3369[label="1;256pkt 256fpkt"];
1291--3369[label="1;256pkt 256fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="89.82.193.10" src_port="1025"/>
    </slice>
    <from sec="1041397344" usec="0"/>
    <to sec="1041397357" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.620401,1.94046,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="202.159.192.25" dst_port="137" proto="tcp" src_ip="61.161.206.11" src_port="1026"/>
      <filter dst_ip="202.159.192.25" dst_port="137" proto="udp" src_ip="61.161.206.11" src_port="1026"/>
      <filter dst_ip="202.159.192.25" dst_port="137" proto="tcp" src_ip="61.161.206.11" src_port="8080"/>
      <filter dst_ip="202.159.192.25" dst_port="137" proto="udp" src_ip="61.161.206.11" src_port="8080"/>
      <from sec="1041397564" usec="0"/>
      <to sec="1041397587" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="202.159.192.25" dst_port="137" proto="tcp" src_ip="203.37.98.11" src_port="1026"/>
      <filter dst_ip="202.159.192.25" dst_port="137" proto="udp" src_ip="203.37.98.11" src_port="1026"/>
      <filter dst_ip="202.159.192.25" dst_port="137" proto="tcp" src_ip="203.37.98.11" src_port="8080"/>
      <filter dst_ip="202.159.192.25" dst_port="137" proto="udp" src_ip="203.37.98.11" src_port="8080"/>
      <from sec="1041397561" usec="0"/>
      <to sec="1041397589" usec="0"/>
    </slice>
    <from sec="1041397561" usec="0"/>
    <to sec="1041397589" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_142{
style=filled;
color=gray75;
123[label="174.170.26.13s;193pkt 193fpkt", shape=rectangle, color=red];
781[label="174.170.26.13s;170pkt 170fpkt", shape=ellipse, color=green];
1293[label="174.170.26.13s;170pkt 170fpkt", shape=triangle, color=blue];
stat142[shape=component, label=&lt;Rules:&lt;BR/&gt;{174.170.26.13:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
123--781[label="1;170pkt 170fpkt"];
123--1293[label="1;170pkt 170fpkt"];
781--1293[label="1;170pkt 170fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="174.170.26.13" src_port="1028"/>
    </slice>
    <from sec="1041397425" usec="0"/>
    <to sec="1041397455" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.02037,1.88019,002,1 1 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_143{
style=filled;
color=gray75;
126[label="205.116.162.13s;135pkt 135fpkt", shape=rectangle, color=red];
783[label="205.116.162.13s;94pkt 94fpkt", shape=ellipse, color=green];
3388[label="205.116.162.13;134pkt 134fpkt", shape=pentagon, color=darkviolet];
4453[label="205.116.162.13;133pkt 133fpkt", shape=invtriangle, color=brown];
5012[label="205.116.162.13;134pkt 134fpkt", shape=invhouse, color=bisque];
stat143[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.116.162.13:1052, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1052: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
126--783[label="1;94pkt 94fpkt"];
126--3388[label="1;134pkt 134fpkt"];
126--4453[label="1;133pkt 133fpkt"];
126--5012[label="1;134pkt 134fpkt"];
783--3388[label="1;94pkt 94fpkt"];
783--4453[label="1;94pkt 94fpkt"];
783--5012[label="1;94pkt 94fpkt"];
3388--4453[label="1;133pkt 133fpkt"];
3388--5012[label="1;134pkt 134fpkt"];
4453--5012[label="1;133pkt 133fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="205.116.162.13" src_port="1052"/>
    </slice>
    <from sec="1041398674" usec="0"/>
    <to sec="1041398696" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_144{
style=filled;
color=gray75;
128[label="61.237.75.14s;189pkt 189fpkt", shape=rectangle, color=red];
784[label="61.237.75.14s;102pkt 102fpkt", shape=ellipse, color=green];
1295[label="61.237.75.14s;102pkt 102fpkt", shape=triangle, color=blue];
stat144[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.237.75.14:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
128--784[label="1;102pkt 102fpkt"];
128--1295[label="1;102pkt 102fpkt"];
784--1295[label="1;102pkt 102fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.237.75.14" src_port="1027"/>
    </slice>
    <from sec="1041398422" usec="0"/>
    <to sec="1041398451" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_145{
style=filled;
color=gray75;
131[label="4.23.27.16s;207pkt 207fpkt", shape=rectangle, color=red];
785[label="4.23.27.16s;207pkt 207fpkt", shape=ellipse, color=green];
1296[label="4.23.27.16s;102pkt 102fpkt", shape=triangle, color=blue];
3401[label="4.23.27.16;250pkt 250fpkt", shape=pentagon, color=darkviolet];
4459[label="4.23.27.16;250pkt 250fpkt", shape=invtriangle, color=brown];
stat145[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.23.27.16:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
131--785[label="1;207pkt 207fpkt"];
131--1296[label="1;102pkt 102fpkt"];
131--3401[label="1;207pkt 207fpkt"];
131--4459[label="1;207pkt 207fpkt"];
785--1296[label="1;102pkt 102fpkt"];
785--3401[label="1;207pkt 207fpkt"];
785--4459[label="1;207pkt 207fpkt"];
1296--3401[label="1;102pkt 102fpkt"];
1296--4459[label="1;102pkt 102fpkt"];
3401--4459[label="1;250pkt 250fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="4.23.27.16" src_port="1028"/>
    </slice>
    <from sec="1041398002" usec="0"/>
    <to sec="1041398042" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_146{
style=filled;
color=gray75;
132[label="23.67.4.17s;216pkt 216fpkt", shape=rectangle, color=red];
786[label="23.67.4.17s;190pkt 190fpkt", shape=ellipse, color=green];
1297[label="23.67.4.17s;116pkt 116fpkt", shape=triangle, color=blue];
stat146[shape=component, label=&lt;Rules:&lt;BR/&gt;{23.67.4.17:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
132--786[label="1;190pkt 190fpkt"];
132--1297[label="1;116pkt 116fpkt"];
786--1297[label="1;116pkt 116fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="23.67.4.17" src_port="1028"/>
    </slice>
    <from sec="1041398253" usec="0"/>
    <to sec="1041398297" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_147{
style=filled;
color=gray75;
133[label="61.136.84.17s;164pkt 164fpkt", shape=rectangle, color=red];
787[label="61.136.84.17s;164pkt 164fpkt", shape=ellipse, color=green];
1298[label="61.136.84.17s;83pkt 83fpkt", shape=triangle, color=blue];
stat147[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.136.84.17:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
133--787[label="1;164pkt 164fpkt"];
133--1298[label="1;83pkt 83fpkt"];
787--1298[label="1;83pkt 83fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.136.84.17" src_port="1029"/>
    </slice>
    <from sec="1041398190" usec="0"/>
    <to sec="1041398219" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_148{
style=filled;
color=gray75;
134[label="217.57.184.17s;185pkt 185fpkt", shape=rectangle, color=red];
788[label="217.57.184.17s;185pkt 185fpkt", shape=ellipse, color=green];
1299[label="217.57.184.17s;157pkt 157fpkt", shape=triangle, color=blue];
3410[label="217.57.184.17;185pkt 185fpkt", shape=pentagon, color=darkviolet];
stat148[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.57.184.17:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
134--788[label="1;185pkt 185fpkt"];
134--1299[label="1;157pkt 157fpkt"];
134--3410[label="1;185pkt 185fpkt"];
788--1299[label="1;157pkt 157fpkt"];
788--3410[label="1;185pkt 185fpkt"];
1299--3410[label="1;157pkt 157fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.57.184.17" src_port="1026"/>
    </slice>
    <from sec="1041397883" usec="0"/>
    <to sec="1041397913" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_149{
style=filled;
color=gray75;
135[label="61.143.229.17s;382pkt 382fpkt", shape=rectangle, color=red];
789[label="61.143.229.17s;341pkt 341fpkt", shape=ellipse, color=green];
1300[label="61.143.229.17s;341pkt 341fpkt", shape=triangle, color=blue];
3412[label="61.143.229.17;382pkt 382fpkt", shape=pentagon, color=darkviolet];
4466[label="61.143.229.17;382pkt 382fpkt", shape=invtriangle, color=brown];
5018[label="61.143.229.17;381pkt 381fpkt", shape=invhouse, color=bisque];
stat149[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.143.229.17:1027, *:137}[51.5707%]&lt;BR/&gt;{61.143.229.17:1028, *:137}[48.4293%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 1028: (25.1245%)&lt;BR/&gt; 1027: (24.8755%)&gt;];
}
135--789[label="1;341pkt 341fpkt"];
135--1300[label="1;341pkt 341fpkt"];
135--3412[label="1;382pkt 382fpkt"];
135--4466[label="1;382pkt 382fpkt"];
135--5018[label="1;381pkt 381fpkt"];
789--1300[label="1;341pkt 341fpkt"];
789--3412[label="1;341pkt 341fpkt"];
789--4466[label="1;341pkt 341fpkt"];
789--5018[label="0.997067;340pkt 340fpkt"];
1300--3412[label="1;341pkt 341fpkt"];
1300--4466[label="1;341pkt 341fpkt"];
1300--5018[label="0.997067;340pkt 340fpkt"];
3412--4466[label="1;382pkt 382fpkt"];
3412--5018[label="1;381pkt 381fpkt"];
4466--5018[label="1;381pkt 381fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.143.229.17" src_port="1027"/>
      <filter dst_port="137" src_ip="61.143.229.17" src_port="1028"/>
    </slice>
    <from sec="1041397746" usec="0"/>
    <to sec="1041397884" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_150{
style=filled;
color=gray75;
136[label="70.107.120.18s;256pkt 256fpkt", shape=rectangle, color=red];
790[label="70.107.120.18s;256pkt 256fpkt", shape=ellipse, color=green];
1301[label="70.107.120.18s;256pkt 256fpkt", shape=triangle, color=blue];
3416[label="70.107.120.18;255pkt 255fpkt", shape=pentagon, color=darkviolet];
4468[label="70.107.120.18;256pkt 256fpkt", shape=invtriangle, color=brown];
stat150[shape=component, label=&lt;Rules:&lt;BR/&gt;{70.107.120.18:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
136--790[label="1;256pkt 256fpkt"];
136--1301[label="1;256pkt 256fpkt"];
136--3416[label="1;255pkt 255fpkt"];
136--4468[label="1;256pkt 256fpkt"];
790--1301[label="1;256pkt 256fpkt"];
790--3416[label="1;255pkt 255fpkt"];
790--4468[label="1;256pkt 256fpkt"];
1301--3416[label="1;255pkt 255fpkt"];
1301--4468[label="1;256pkt 256fpkt"];
3416--4468[label="1;255pkt 255fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="70.107.120.18" src_port="1026"/>
    </slice>
    <from sec="1041398674" usec="0"/>
    <to sec="1041398697" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_151{
style=filled;
color=gray75;
137[label="216.241.144.18s;162pkt 162fpkt", shape=rectangle, color=red];
791[label="216.241.144.18s;111pkt 111fpkt", shape=ellipse, color=green];
1302[label="216.241.144.18s;111pkt 111fpkt", shape=triangle, color=blue];
3417[label="216.241.144.18;245pkt 245fpkt", shape=pentagon, color=darkviolet];
stat151[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.241.144.18:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
137--791[label="1;111pkt 111fpkt"];
137--1302[label="1;111pkt 111fpkt"];
137--3417[label="1;162pkt 162fpkt"];
791--1302[label="1;111pkt 111fpkt"];
791--3417[label="1;111pkt 111fpkt"];
1302--3417[label="1;111pkt 111fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="216.241.144.18" src_port="1026"/>
    </slice>
    <from sec="1041397949" usec="0"/>
    <to sec="1041397993" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_152{
style=filled;
color=gray75;
138[label="209.162.162.19s;165pkt 165fpkt", shape=rectangle, color=red];
792[label="209.162.162.19s;142pkt 142fpkt", shape=ellipse, color=green];
1357[label="90.18.149.67s;405pkt 405fpkt", shape=triangle, color=blue];
3421[label="209.162.162.19;165pkt 165fpkt", shape=pentagon, color=darkviolet];
4470[label="209.162.162.19;165pkt 165fpkt", shape=invtriangle, color=brown];
5019[label="209.162.162.19;165pkt 165fpkt", shape=invhouse, color=bisque];
stat152[shape=component, label=&lt;Rules:&lt;BR/&gt;{90.18.149.67:1027, *:137}[60.6635%]&lt;BR/&gt;{209.162.162.19:1025, *:137}[39.0995%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (49.9586%)&lt;BR/&gt; 1025: (39.3952%)&lt;BR/&gt; 1027: (10.6048%)&lt;BR/&gt; 25: (0.041425%)&gt;];
}
138--792[label="1;142pkt 142fpkt"];
138--1357[label="0.89697;148pkt 148fpkt"];
138--3421[label="1;165pkt 165fpkt"];
138--4470[label="1;165pkt 165fpkt"];
138--5019[label="1;165pkt 165fpkt"];
792--1357[label="1;142pkt 142fpkt"];
792--3421[label="1;142pkt 142fpkt"];
792--4470[label="1;142pkt 142fpkt"];
792--5019[label="1;142pkt 142fpkt"];
1357--1950[label="0.00246914;1pkt 1fpkt"];
1357--3054[label="0.00246914;1pkt 1fpkt"];
1357--3421[label="0.89697;148pkt 148fpkt"];
1357--3634[label="1;256pkt 256fpkt"];
1357--4470[label="0.89697;148pkt 148fpkt"];
1357--5019[label="0.89697;148pkt 148fpkt"];
3421--4470[label="1;165pkt 165fpkt"];
3421--5019[label="1;165pkt 165fpkt"];
4470--5019[label="1;165pkt 165fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="90.18.149.67" src_port="1027"/>
      <filter dst_port="137" src_ip="209.162.162.19" src_port="1025"/>
    </slice>
    <from sec="1041397655" usec="0"/>
    <to sec="1041397685" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_153{
style=filled;
color=gray75;
140[label="61.95.39.21s;176pkt 176fpkt", shape=rectangle, color=red];
793[label="61.95.39.21s;176pkt 176fpkt", shape=ellipse, color=green];
1303[label="61.95.39.21s;136pkt 136fpkt", shape=triangle, color=blue];
3432[label="61.95.39.21;189pkt 189fpkt", shape=pentagon, color=darkviolet];
stat153[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.95.39.21:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
140--793[label="1;176pkt 176fpkt"];
140--1303[label="1;136pkt 136fpkt"];
140--3432[label="1;176pkt 176fpkt"];
793--1303[label="1;136pkt 136fpkt"];
793--3432[label="1;176pkt 176fpkt"];
1303--3432[label="1;136pkt 136fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.95.39.21" src_port="1027"/>
    </slice>
    <from sec="1041397992" usec="0"/>
    <to sec="1041398026" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_154{
style=filled;
color=gray75;
141[label="4.143.148.21s;251pkt 251fpkt", shape=rectangle, color=red];
794[label="4.143.148.21s;251pkt 251fpkt", shape=ellipse, color=green];
stat154[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.143.148.21:1030, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1030: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
141--794[label="1;251pkt 251fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="4.143.148.21" src_port="1030"/>
    </slice>
    <from sec="1041397921" usec="0"/>
    <to sec="1041397962" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_155{
style=filled;
color=gray75;
143[label="211.65.173.22s;183pkt 183fpkt", shape=rectangle, color=red];
796[label="211.65.173.22s;90pkt 90fpkt", shape=ellipse, color=green];
1305[label="211.65.173.22s;90pkt 90fpkt", shape=triangle, color=blue];
3439[label="211.65.173.22;183pkt 183fpkt", shape=pentagon, color=darkviolet];
stat155[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.65.173.22:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
143--796[label="1;90pkt 90fpkt"];
143--1305[label="1;90pkt 90fpkt"];
143--3439[label="1;183pkt 183fpkt"];
796--1305[label="1;90pkt 90fpkt"];
796--3439[label="1;90pkt 90fpkt"];
1305--3439[label="1;90pkt 90fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="211.65.173.22" src_port="1029"/>
    </slice>
    <from sec="1041398057" usec="0"/>
    <to sec="1041398087" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_156{
style=filled;
color=gray75;
145[label="61.110.2.24s;153pkt 153fpkt", shape=rectangle, color=red];
798[label="61.110.2.24s;153pkt 153fpkt", shape=ellipse, color=green];
1306[label="61.110.2.24s;153pkt 153fpkt", shape=triangle, color=blue];
3447[label="61.110.2.24;153pkt 153fpkt", shape=pentagon, color=darkviolet];
4479[label="61.110.2.24;153pkt 153fpkt", shape=invtriangle, color=brown];
5026[label="61.110.2.24;153pkt 153fpkt", shape=invhouse, color=bisque];
stat156[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.110.2.24:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
145--798[label="1;153pkt 153fpkt"];
145--1306[label="1;153pkt 153fpkt"];
145--3447[label="1;153pkt 153fpkt"];
145--4479[label="1;153pkt 153fpkt"];
145--5026[label="1;153pkt 153fpkt"];
798--1306[label="1;153pkt 153fpkt"];
798--3447[label="1;153pkt 153fpkt"];
798--4479[label="1;153pkt 153fpkt"];
798--5026[label="1;153pkt 153fpkt"];
1306--3447[label="1;153pkt 153fpkt"];
1306--4479[label="1;153pkt 153fpkt"];
1306--5026[label="1;153pkt 153fpkt"];
3447--4479[label="1;153pkt 153fpkt"];
3447--5026[label="1;153pkt 153fpkt"];
4479--5026[label="1;153pkt 153fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.110.2.24" src_port="1028"/>
    </slice>
    <from sec="1041397373" usec="0"/>
    <to sec="1041397399" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_157{
style=filled;
color=gray75;
146[label="61.235.2.24s;128pkt 128fpkt", shape=rectangle, color=red];
799[label="61.235.2.24s;95pkt 95fpkt", shape=ellipse, color=green];
1307[label="61.235.2.24s;95pkt 95fpkt", shape=triangle, color=blue];
stat157[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.235.2.24:1030, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1030: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
146--799[label="1;95pkt 95fpkt"];
146--1307[label="1;95pkt 95fpkt"];
799--1307[label="1;95pkt 95fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.235.2.24" src_port="1030"/>
    </slice>
    <from sec="1041398059" usec="0"/>
    <to sec="1041398087" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_158{
style=filled;
color=gray75;
150[label="61.143.229.24s;240pkt 240fpkt", shape=rectangle, color=red];
801[label="61.143.229.24s;72pkt 72fpkt", shape=ellipse, color=green];
1308[label="61.143.229.24s;72pkt 72fpkt", shape=triangle, color=blue];
stat158[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.143.229.24:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
150--801[label="1;72pkt 72fpkt"];
150--1308[label="1;72pkt 72fpkt"];
801--1308[label="1;72pkt 72fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.143.229.24" src_port="1027"/>
    </slice>
    <from sec="1041398408" usec="0"/>
    <to sec="1041398450" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_159{
style=filled;
color=gray75;
151[label="210.89.11.25s;86pkt 86fpkt", shape=rectangle, color=red];
802[label="210.89.11.25s;86pkt 86fpkt", shape=ellipse, color=green];
1309[label="210.89.11.25s;86pkt 86fpkt", shape=triangle, color=blue];
stat159[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.89.11.25:1032, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1032: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
151--802[label="1;86pkt 86fpkt"];
151--1309[label="1;86pkt 86fpkt"];
802--1309[label="1;86pkt 86fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="210.89.11.25" src_port="1032"/>
    </slice>
    <from sec="1041397687" usec="0"/>
    <to sec="1041397705" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_160{
style=filled;
color=gray75;
157[label="202.214.90.27s;77pkt 77fpkt", shape=rectangle, color=red];
805[label="202.214.90.27s;77pkt 77fpkt", shape=ellipse, color=green];
1312[label="202.214.90.27s;77pkt 77fpkt", shape=triangle, color=blue];
stat160[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.214.90.27:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
157--805[label="1;77pkt 77fpkt"];
157--1312[label="1;77pkt 77fpkt"];
805--1312[label="1;77pkt 77fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="202.214.90.27" src_port="1029"/>
    </slice>
    <from sec="1041397687" usec="0"/>
    <to sec="1041397705" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_161{
style=filled;
color=gray75;
158[label="217.67.142.27s;242pkt 242fpkt", shape=rectangle, color=red];
806[label="217.67.142.27s;242pkt 242fpkt", shape=ellipse, color=green];
1313[label="217.67.142.27s;242pkt 242fpkt", shape=triangle, color=blue];
3466[label="217.67.142.27;241pkt 241fpkt", shape=pentagon, color=darkviolet];
4489[label="217.67.142.27;241pkt 241fpkt", shape=invtriangle, color=brown];
5032[label="217.67.142.27;241pkt 241fpkt", shape=invhouse, color=bisque];
stat161[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.67.142.27:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
158--806[label="1;242pkt 242fpkt"];
158--1313[label="1;242pkt 242fpkt"];
158--3466[label="1;241pkt 241fpkt"];
158--4489[label="1;241pkt 241fpkt"];
158--5032[label="1;241pkt 241fpkt"];
806--1313[label="1;242pkt 242fpkt"];
806--3466[label="1;241pkt 241fpkt"];
806--4489[label="1;241pkt 241fpkt"];
806--5032[label="1;241pkt 241fpkt"];
1313--3466[label="1;241pkt 241fpkt"];
1313--4489[label="1;241pkt 241fpkt"];
1313--5032[label="1;241pkt 241fpkt"];
3466--4489[label="1;241pkt 241fpkt"];
3466--5032[label="1;241pkt 241fpkt"];
4489--5032[label="1;241pkt 241fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.67.142.27" src_port="1025"/>
    </slice>
    <from sec="1041397698" usec="0"/>
    <to sec="1041397736" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.0989,1.87859,999,1 1 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_162{
style=filled;
color=gray75;
18[label="90.14.128.28s;1pkt 1fpkt", shape=rectangle, color=red];
807[label="217.49.64.28s;1pkt 1fpkt", shape=ellipse, color=green];
1704[label="172.142.208.139;d;17pkt 17fpkt", shape=diamond, color=yellow];
1744[label="174.0.36.201;s;9pkt 9fpkt", shape=diamond, color=yellow];
1978[label="90.14.128.28;s;3pkt 3fpkt", shape=diamond, color=yellow];
2806[label="90.14.128.28;s;3pkt 3fpkt", shape=hexagon, color=black];
3327[label="90.222.49.4;11pkt 11fpkt", shape=pentagon, color=darkviolet];
stat162[shape=component, label=&lt;Rules:&lt;BR/&gt;{90.222.49.4:*, *:25}[40.7407%]&lt;BR/&gt;{174.0.36.201:20, 172.142.208.139:*}[29.6296%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 20: (26.6667%)&lt;BR/&gt; 25: (17.7778%)&lt;BR/&gt; 56336: (5.55556%)&lt;BR/&gt; 21: (5.55556%)&lt;BR/&gt; 56033: (3.33333%)&gt;];
}
18--807[label="1;1pkt 1fpkt"];
18--1704[label="1;1pkt 1fpkt"];
18--1978[label="1;1pkt 1fpkt"];
18--2806[label="1;1pkt 1fpkt"];
807--1704[label="1;1pkt 1fpkt"];
807--1978[label="1;1pkt 1fpkt"];
807--2806[label="1;1pkt 1fpkt"];
1704--1744[label="1;9pkt 9fpkt"];
1704--1978[label="1;3pkt 3fpkt"];
1704--2806[label="1;3pkt 3fpkt"];
1704--3327[label="0.0909091;1pkt 1fpkt"];
1978--2806[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_port="25" src_ip="90.222.49.4"/>
      <filter dst_ip="172.142.208.139" src_ip="174.0.36.201" src_port="20"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.770694,1.8419,002,1 1 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_163{
style=filled;
color=gray75;
162[label="61.161.18.29s;110pkt 110fpkt", shape=rectangle, color=red];
810[label="61.161.18.29s;110pkt 110fpkt", shape=ellipse, color=green];
3473[label="61.161.18.29;191pkt 191fpkt", shape=pentagon, color=darkviolet];
4493[label="61.161.18.29;190pkt 190fpkt", shape=invtriangle, color=brown];
stat163[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.161.18.29:1030, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1030: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
162--810[label="1;110pkt 110fpkt"];
162--3473[label="1;110pkt 110fpkt"];
162--4493[label="1;110pkt 110fpkt"];
810--3473[label="1;110pkt 110fpkt"];
810--4493[label="1;110pkt 110fpkt"];
3473--4493[label="1;190pkt 190fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.161.18.29" src_port="1030"/>
    </slice>
    <from sec="1041398587" usec="0"/>
    <to sec="1041398619" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_164{
style=filled;
color=gray75;
165[label="4.104.135.30s;139pkt 139fpkt", shape=rectangle, color=red];
813[label="4.104.135.30s;123pkt 123fpkt", shape=ellipse, color=green];
1317[label="4.104.135.30s;123pkt 123fpkt", shape=triangle, color=blue];
stat164[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.104.135.30:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
165--813[label="1;123pkt 123fpkt"];
165--1317[label="1;123pkt 123fpkt"];
813--1317[label="1;123pkt 123fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="4.104.135.30" src_port="1026"/>
    </slice>
    <from sec="1041397378" usec="0"/>
    <to sec="1041397402" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.770694,1.8419,002,1 1 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_165{
style=filled;
color=gray75;
166[label="154.171.156.30s;195pkt 195fpkt", shape=rectangle, color=red];
814[label="154.171.156.30s;195pkt 195fpkt", shape=ellipse, color=green];
3482[label="154.171.156.30;248pkt 248fpkt", shape=pentagon, color=darkviolet];
4495[label="154.171.156.30;248pkt 248fpkt", shape=invtriangle, color=brown];
stat165[shape=component, label=&lt;Rules:&lt;BR/&gt;{154.171.156.30:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
166--814[label="1;195pkt 195fpkt"];
166--3482[label="0.994872;194pkt 194fpkt"];
166--4495[label="0.994872;194pkt 194fpkt"];
814--3482[label="0.994872;194pkt 194fpkt"];
814--4495[label="0.994872;194pkt 194fpkt"];
3482--4495[label="1;248pkt 248fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="154.171.156.30" src_port="1025"/>
    </slice>
    <from sec="1041397943" usec="0"/>
    <to sec="1041397982" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_166{
style=filled;
color=gray75;
168[label="61.137.224.30s;186pkt 186fpkt", shape=rectangle, color=red];
816[label="61.137.224.30s;219pkt 219fpkt", shape=ellipse, color=green];
1319[label="61.137.224.30s;219pkt 219fpkt", shape=triangle, color=blue];
stat166[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.137.224.30:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
168--816[label="1;186pkt 186fpkt"];
168--1319[label="1;186pkt 186fpkt"];
816--1319[label="1;219pkt 219fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.137.224.30" src_port="1025"/>
    </slice>
    <from sec="1041398229" usec="0"/>
    <to sec="1041398263" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_168{
style=filled;
color=gray75;
171[label="63.37.42.32s;133pkt 133fpkt", shape=rectangle, color=red];
818[label="63.37.42.32s;83pkt 83fpkt", shape=ellipse, color=green];
1321[label="63.37.42.32s;83pkt 83fpkt", shape=triangle, color=blue];
stat168[shape=component, label=&lt;Rules:&lt;BR/&gt;{63.37.42.32:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
171--818[label="1;83pkt 83fpkt"];
171--1321[label="1;83pkt 83fpkt"];
818--1321[label="1;83pkt 83fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="63.37.42.32" src_port="1025"/>
    </slice>
    <from sec="1041397315" usec="0"/>
    <to sec="1041397340" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,999,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_169{
style=filled;
color=gray75;
173[label="217.57.109.33s;1pkt 1fpkt", shape=rectangle, color=red];
819[label="217.57.109.33s;1pkt 1fpkt", shape=ellipse, color=green];
stat169[shape=component, label=&lt;Rules:&lt;BR/&gt;{90.222.49.33:28368, 172.142.194.168:25}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 28368: (50%)&lt;BR/&gt; 25: (50%)&gt;];
}
173--819[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="172.142.194.168" dst_port="25" src_ip="90.222.49.33" src_port="28368"/>
    </slice>
    <from sec="1041397298" usec="0"/>
    <to sec="1041397326" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.620401,1.94046,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="4.26.186.34" src_port="1025"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="4.26.186.34" src_port="1025"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="4.26.186.34" src_port="80"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="4.26.186.34" src_port="80"/>
      <from sec="1041398483" usec="0"/>
      <to sec="1041398511" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="218.159.150.34" src_port="1025"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="218.159.150.34" src_port="1025"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="218.159.150.34" src_port="80"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="218.159.150.34" src_port="80"/>
      <from sec="1041398485" usec="0"/>
      <to sec="1041398516" usec="0"/>
    </slice>
    <from sec="1041398483" usec="0"/>
    <to sec="1041398516" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_171{
style=filled;
color=gray75;
175[label="91.88.8.35s;99pkt 99fpkt", shape=rectangle, color=red];
821[label="91.88.8.35s;99pkt 99fpkt", shape=ellipse, color=green];
1322[label="91.88.8.35s;99pkt 99fpkt", shape=triangle, color=blue];
3500[label="91.88.8.35;172pkt 172fpkt", shape=pentagon, color=darkviolet];
4506[label="91.88.8.35;172pkt 172fpkt", shape=invtriangle, color=brown];
5044[label="91.88.8.35;172pkt 172fpkt", shape=invhouse, color=bisque];
stat171[shape=component, label=&lt;Rules:&lt;BR/&gt;{91.88.8.35:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
175--821[label="1;99pkt 99fpkt"];
175--1322[label="1;99pkt 99fpkt"];
175--3500[label="1;99pkt 99fpkt"];
175--4506[label="1;99pkt 99fpkt"];
175--5044[label="1;99pkt 99fpkt"];
821--1322[label="1;99pkt 99fpkt"];
821--3500[label="1;99pkt 99fpkt"];
821--4506[label="1;99pkt 99fpkt"];
821--5044[label="1;99pkt 99fpkt"];
1322--3500[label="1;99pkt 99fpkt"];
1322--4506[label="1;99pkt 99fpkt"];
1322--5044[label="1;99pkt 99fpkt"];
3500--4506[label="1;172pkt 172fpkt"];
3500--5044[label="1;172pkt 172fpkt"];
4506--5044[label="1;172pkt 172fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="91.88.8.35" src_port="1028"/>
    </slice>
    <from sec="1041398015" usec="0"/>
    <to sec="1041398042" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_172{
style=filled;
color=gray75;
179[label="217.68.33.38s;195pkt 195fpkt", shape=rectangle, color=red];
825[label="217.68.33.38s;195pkt 195fpkt", shape=ellipse, color=green];
1326[label="217.68.33.38s;110pkt 110fpkt", shape=triangle, color=blue];
3509[label="217.68.33.38;211pkt 211fpkt", shape=pentagon, color=darkviolet];
4510[label="217.68.33.38;212pkt 212fpkt", shape=invtriangle, color=brown];
5046[label="217.68.33.38;211pkt 211fpkt", shape=invhouse, color=bisque];
stat172[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.68.33.38:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
179--825[label="1;195pkt 195fpkt"];
179--1326[label="1;110pkt 110fpkt"];
179--3509[label="0.994872;194pkt 194fpkt"];
179--4510[label="1;195pkt 195fpkt"];
179--5046[label="0.994872;194pkt 194fpkt"];
825--1326[label="1;110pkt 110fpkt"];
825--3509[label="0.994872;194pkt 194fpkt"];
825--4510[label="1;195pkt 195fpkt"];
825--5046[label="0.994872;194pkt 194fpkt"];
1326--3509[label="1;110pkt 110fpkt"];
1326--4510[label="1;110pkt 110fpkt"];
1326--5046[label="1;110pkt 110fpkt"];
3509--4510[label="1;211pkt 211fpkt"];
3509--5046[label="1;211pkt 211fpkt"];
4510--5046[label="1;211pkt 211fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.68.33.38" src_port="1028"/>
    </slice>
    <from sec="1041397946" usec="0"/>
    <to sec="1041397979" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_173{
style=filled;
color=gray75;
182[label="61.204.233.39s;91pkt 91fpkt", shape=rectangle, color=red];
828[label="61.204.233.39s;91pkt 91fpkt", shape=ellipse, color=green];
stat173[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.204.233.39:1030, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1030: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
182--828[label="1;91pkt 91fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.204.233.39" src_port="1030"/>
    </slice>
    <from sec="1041398681" usec="0"/>
    <to sec="1041398696" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_174{
style=filled;
color=gray75;
184[label="61.143.229.40s;75pkt 75fpkt", shape=rectangle, color=red];
830[label="61.143.229.40s;75pkt 75fpkt", shape=ellipse, color=green];
stat174[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.143.229.40:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
184--830[label="1;75pkt 75fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.143.229.40" src_port="1027"/>
    </slice>
    <from sec="1041398587" usec="0"/>
    <to sec="1041398599" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.620401,1.94046,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="202.159.194.95" dst_port="137" proto="udp" src_ip="61.206.116.42" src_port="10968"/>
      <filter dst_ip="202.159.194.95" dst_port="137" proto="icmp" src_ip="61.206.116.42" src_port="10968"/>
      <from sec="1041398235" usec="0"/>
      <to sec="1041398265" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="202.159.194.95" dst_port="137" proto="udp" src_ip="203.37.116.42" src_port="10968"/>
      <filter dst_ip="202.159.194.95" dst_port="137" proto="icmp" src_ip="203.37.116.42" src_port="10968"/>
      <from sec="1041398235" usec="0"/>
      <to sec="1041398264" usec="0"/>
    </slice>
    <from sec="1041398235" usec="0"/>
    <to sec="1041398265" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.27983,1.95571,999,1 1 0 1 1 0 0 0 0 0 0 1 ">
    <description>subgraph cluster_176{
style=filled;
color=gray75;
187[label="70.96.138.42s;1pkt 1fpkt", shape=rectangle, color=red];
832[label="70.96.138.42s;1pkt 1fpkt", shape=ellipse, color=green];
2602[label="61.135.90.42;s;2pkt 2fpkt", shape=diamond, color=yellow];
3140[label="61.135.90.42;s;2pkt 2fpkt", shape=hexagon, color=black];
5054[label="61.135.90.42;2pkt 2fpkt", shape=invhouse, color=bisque];
stat176[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.135.90.42:5121, 202.145.26.205:1361}[50%]&lt;BR/&gt;{61.135.90.42:5121, 202.145.26.205:1376}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5121: (50%)&lt;BR/&gt; 1361: (31.25%)&lt;BR/&gt; 1376: (18.75%)&gt;];
}
187--832[label="1;1pkt 1fpkt"];
187--1330[label="1;1pkt 1fpkt"];
187--1815[label="1;1pkt 1fpkt"];
187--2602[label="1;1pkt 1fpkt"];
187--3140[label="1;1pkt 1fpkt"];
187--5054[label="1;1pkt 1fpkt"];
832--1330[label="1;1pkt 1fpkt"];
832--1815[label="1;1pkt 1fpkt"];
832--2602[label="1;1pkt 1fpkt"];
832--3140[label="1;1pkt 1fpkt"];
832--5054[label="1;1pkt 1fpkt"];
2602--3140[label="1;2pkt 2fpkt"];
2602--3530[label="1;1pkt 1fpkt"];
2602--4524[label="1;1pkt 1fpkt"];
2602--5054[label="1;2pkt 2fpkt"];
3140--3530[label="1;1pkt 1fpkt"];
3140--4524[label="1;1pkt 1fpkt"];
3140--5054[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="202.145.26.205" dst_port="1376" src_ip="61.135.90.42" src_port="5121"/>
      <filter dst_ip="202.145.26.205" dst_port="1361" src_ip="61.135.90.42" src_port="5121"/>
    </slice>
    <from sec="1041398248" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_177{
style=filled;
color=gray75;
189[label="61.98.162.43s;307pkt 307fpkt", shape=rectangle, color=red];
834[label="61.98.162.43s;307pkt 307fpkt", shape=ellipse, color=green];
1332[label="61.98.162.43s;256pkt 256fpkt", shape=triangle, color=blue];
stat177[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.98.162.43:1058, *:137}[83.3876%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 1058: (44.1379%)&lt;BR/&gt; 1027: (5.86207%)&gt;];
}
189--834[label="1;307pkt 307fpkt"];
189--1332[label="1;256pkt 256fpkt"];
834--1332[label="1;256pkt 256fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.98.162.43" src_port="1058"/>
    </slice>
    <from sec="1041397361" usec="0"/>
    <to sec="1041397512" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_178{
style=filled;
color=gray75;
190[label="217.79.10.44s;235pkt 235fpkt", shape=rectangle, color=red];
835[label="217.79.10.44s;146pkt 146fpkt", shape=ellipse, color=green];
1333[label="217.79.10.44s;81pkt 81fpkt", shape=triangle, color=blue];
3541[label="217.79.10.44;249pkt 249fpkt", shape=pentagon, color=darkviolet];
stat178[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.79.10.44:1151, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1151: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
190--835[label="1;146pkt 146fpkt"];
190--1333[label="1;81pkt 81fpkt"];
190--3541[label="0.995745;234pkt 234fpkt"];
835--1333[label="1;81pkt 81fpkt"];
835--3541[label="0.993151;145pkt 145fpkt"];
1333--3541[label="0.987654;80pkt 80fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.79.10.44" src_port="1151"/>
    </slice>
    <from sec="1041397428" usec="0"/>
    <to sec="1041397481" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.620401,1.94046,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="141.0.187.243" dst_port="137" proto="tcp" src_ip="218.235.134.45" src_port="1028"/>
      <filter dst_ip="141.0.187.243" dst_port="137" proto="udp" src_ip="218.235.134.45" src_port="1028"/>
      <filter dst_ip="141.0.187.243" dst_port="2064" proto="tcp" src_ip="218.235.134.45" src_port="1028"/>
      <filter dst_ip="141.0.187.243" dst_port="2064" proto="udp" src_ip="218.235.134.45" src_port="1028"/>
      <filter dst_ip="145.117.103.184" dst_port="137" proto="tcp" src_ip="218.235.134.45" src_port="1028"/>
      <filter dst_ip="145.117.103.184" dst_port="137" proto="udp" src_ip="218.235.134.45" src_port="1028"/>
      <filter dst_ip="145.117.103.184" dst_port="2064" proto="tcp" src_ip="218.235.134.45" src_port="1028"/>
      <filter dst_ip="145.117.103.184" dst_port="2064" proto="udp" src_ip="218.235.134.45" src_port="1028"/>
      <from sec="1041397589" usec="0"/>
      <to sec="1041397604" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="141.0.187.243" dst_port="137" proto="tcp" src_ip="148.144.206.45" src_port="1028"/>
      <filter dst_ip="141.0.187.243" dst_port="137" proto="udp" src_ip="148.144.206.45" src_port="1028"/>
      <filter dst_ip="141.0.187.243" dst_port="2064" proto="tcp" src_ip="148.144.206.45" src_port="1028"/>
      <filter dst_ip="141.0.187.243" dst_port="2064" proto="udp" src_ip="148.144.206.45" src_port="1028"/>
      <filter dst_ip="145.117.103.184" dst_port="137" proto="tcp" src_ip="148.144.206.45" src_port="1028"/>
      <filter dst_ip="145.117.103.184" dst_port="137" proto="udp" src_ip="148.144.206.45" src_port="1028"/>
      <filter dst_ip="145.117.103.184" dst_port="2064" proto="tcp" src_ip="148.144.206.45" src_port="1028"/>
      <filter dst_ip="145.117.103.184" dst_port="2064" proto="udp" src_ip="148.144.206.45" src_port="1028"/>
      <from sec="1041397589" usec="0"/>
      <to sec="1041397605" usec="0"/>
    </slice>
    <from sec="1041397589" usec="0"/>
    <to sec="1041397605" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_180{
style=filled;
color=gray75;
194[label="217.134.156.45s;85pkt 85fpkt", shape=rectangle, color=red];
837[label="217.134.156.45s;85pkt 85fpkt", shape=ellipse, color=green];
stat180[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.134.156.45:61527, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 61527: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
194--837[label="1;85pkt 85fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.134.156.45" src_port="61527"/>
    </slice>
    <from sec="1041397612" usec="0"/>
    <to sec="1041397626" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_181{
style=filled;
color=gray75;
197[label="216.241.11.47s;87pkt 87fpkt", shape=rectangle, color=red];
839[label="216.241.11.47s;87pkt 87fpkt", shape=ellipse, color=green];
stat181[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.241.11.47:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
197--839[label="1;87pkt 87fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="216.241.11.47" src_port="1028"/>
    </slice>
    <from sec="1041398696" usec="0"/>
    <to sec="1041398711" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.620401,1.94046,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="70.148.102.47" src_port="11972"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="70.148.102.47" src_port="11972"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="70.148.102.47" src_port="80"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="70.148.102.47" src_port="80"/>
      <from sec="1041398598" usec="0"/>
      <to sec="1041398625" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="218.159.150.47" src_port="11972"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="218.159.150.47" src_port="11972"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="218.159.150.47" src_port="80"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="218.159.150.47" src_port="80"/>
      <from sec="1041398603" usec="0"/>
      <to sec="1041398631" usec="0"/>
    </slice>
    <from sec="1041398598" usec="0"/>
    <to sec="1041398632" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_183{
style=filled;
color=gray75;
199[label="203.206.21.49s;120pkt 120fpkt", shape=rectangle, color=red];
841[label="203.206.21.49s;120pkt 120fpkt", shape=ellipse, color=green];
1337[label="203.206.21.49s;120pkt 120fpkt", shape=triangle, color=blue];
stat183[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.206.21.49:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
199--841[label="1;120pkt 120fpkt"];
199--1337[label="1;120pkt 120fpkt"];
841--1337[label="1;120pkt 120fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="203.206.21.49" src_port="1028"/>
    </slice>
    <from sec="1041397737" usec="0"/>
    <to sec="1041397754" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_184{
style=filled;
color=gray75;
201[label="90.72.1.50s;89pkt 89fpkt", shape=rectangle, color=red];
843[label="90.72.1.50s;89pkt 89fpkt", shape=ellipse, color=green];
stat184[shape=component, label=&lt;Rules:&lt;BR/&gt;{90.72.1.50:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
201--843[label="1;89pkt 89fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="90.72.1.50" src_port="1028"/>
    </slice>
    <from sec="1041398158" usec="0"/>
    <to sec="1041398175" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_185{
style=filled;
color=gray75;
202[label="61.238.66.50s;127pkt 127fpkt", shape=rectangle, color=red];
844[label="61.238.66.50s;127pkt 127fpkt", shape=ellipse, color=green];
1338[label="61.238.66.50s;76pkt 76fpkt", shape=triangle, color=blue];
stat185[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.238.66.50:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
202--844[label="1;127pkt 127fpkt"];
202--1338[label="1;76pkt 76fpkt"];
844--1338[label="1;76pkt 76fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.238.66.50" src_port="1026"/>
    </slice>
    <from sec="1041397758" usec="0"/>
    <to sec="1041397782" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,999,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_186{
style=filled;
color=gray75;
203[label="61.250.173.50s;1pkt 1fpkt", shape=rectangle, color=red];
845[label="61.250.173.50s;1pkt 1fpkt", shape=ellipse, color=green];
1339[label="61.250.173.50s;1pkt 1fpkt", shape=triangle, color=blue];
stat186[shape=component, label=&lt;Rules:&lt;BR/&gt;{90.222.49.50:43931, 172.142.195.159:25}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 43931: (50%)&lt;BR/&gt; 25: (50%)&gt;];
}
203--845[label="1;1pkt 1fpkt"];
203--1339[label="1;1pkt 1fpkt"];
845--1339[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="172.142.195.159" dst_port="25" src_ip="90.222.49.50" src_port="43931"/>
    </slice>
    <from sec="1041398096" usec="0"/>
    <to sec="1041398140" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_187{
style=filled;
color=gray75;
209[label="217.214.94.54s;171pkt 171fpkt", shape=rectangle, color=red];
849[label="217.214.94.54s;86pkt 86fpkt", shape=ellipse, color=green];
1343[label="217.214.94.54s;86pkt 86fpkt", shape=triangle, color=blue];
stat187[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.214.94.54:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
209--849[label="1;86pkt 86fpkt"];
209--1343[label="1;86pkt 86fpkt"];
849--1343[label="1;86pkt 86fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.214.94.54" src_port="1028"/>
    </slice>
    <from sec="1041398318" usec="0"/>
    <to sec="1041398352" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_188{
style=filled;
color=gray75;
210[label="202.86.160.54s;112pkt 112fpkt", shape=rectangle, color=red];
850[label="202.86.160.54s;112pkt 112fpkt", shape=ellipse, color=green];
1344[label="202.86.160.54s;112pkt 112fpkt", shape=triangle, color=blue];
stat188[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.86.160.54:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
210--850[label="1;112pkt 112fpkt"];
210--1344[label="1;112pkt 112fpkt"];
850--1344[label="1;112pkt 112fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="202.86.160.54" src_port="1026"/>
    </slice>
    <from sec="1041398569" usec="0"/>
    <to sec="1041398585" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_189{
style=filled;
color=gray75;
211[label="200.78.129.55s;89pkt 89fpkt", shape=rectangle, color=red];
851[label="200.78.129.55s;89pkt 89fpkt", shape=ellipse, color=green];
stat189[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.78.129.55:64445, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 64445: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
211--851[label="1;89pkt 89fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="200.78.129.55" src_port="64445"/>
    </slice>
    <from sec="1041398246" usec="0"/>
    <to sec="1041398266" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_190{
style=filled;
color=gray75;
214[label="217.74.179.56s;49pkt 49fpkt", shape=rectangle, color=red];
853[label="217.74.179.56s;49pkt 49fpkt", shape=ellipse, color=green];
stat190[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.74.179.56:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
214--853[label="1;49pkt 49fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.74.179.56" src_port="1029"/>
    </slice>
    <from sec="1041397889" usec="0"/>
    <to sec="1041397902" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_191{
style=filled;
color=gray75;
220[label="217.62.227.60s;72pkt 72fpkt", shape=rectangle, color=red];
857[label="217.62.227.60s;72pkt 72fpkt", shape=ellipse, color=green];
1349[label="217.62.227.60s;72pkt 72fpkt", shape=triangle, color=blue];
stat191[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.62.227.60:1031, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1031: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
220--857[label="1;72pkt 72fpkt"];
220--1349[label="1;72pkt 72fpkt"];
857--1349[label="1;72pkt 72fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.62.227.60" src_port="1031"/>
    </slice>
    <from sec="1041398344" usec="0"/>
    <to sec="1041398359" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_192{
style=filled;
color=gray75;
222[label="217.133.52.62s;104pkt 104fpkt", shape=rectangle, color=red];
858[label="217.133.52.62s;104pkt 104fpkt", shape=ellipse, color=green];
1350[label="217.133.52.62s;104pkt 104fpkt", shape=triangle, color=blue];
stat192[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.133.52.62:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
222--858[label="1;104pkt 104fpkt"];
222--1350[label="1;104pkt 104fpkt"];
858--1350[label="1;104pkt 104fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.133.52.62" src_port="1026"/>
    </slice>
    <from sec="1041397918" usec="0"/>
    <to sec="1041397935" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_193{
style=filled;
color=gray75;
227[label="90.218.40.67s;95pkt 95fpkt", shape=rectangle, color=red];
862[label="90.218.40.67s;95pkt 95fpkt", shape=ellipse, color=green];
1354[label="90.218.40.67s;95pkt 95fpkt", shape=triangle, color=blue];
3631[label="90.218.40.67;148pkt 148fpkt", shape=pentagon, color=darkviolet];
4575[label="90.218.40.67;147pkt 147fpkt", shape=invtriangle, color=brown];
5079[label="90.218.40.67;147pkt 147fpkt", shape=invhouse, color=bisque];
stat193[shape=component, label=&lt;Rules:&lt;BR/&gt;{90.218.40.67:1032, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1032: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
227--862[label="1;95pkt 95fpkt"];
227--1354[label="1;95pkt 95fpkt"];
227--3631[label="1;95pkt 95fpkt"];
227--4575[label="1;95pkt 95fpkt"];
227--5079[label="1;95pkt 95fpkt"];
862--1354[label="1;95pkt 95fpkt"];
862--3631[label="1;95pkt 95fpkt"];
862--4575[label="1;95pkt 95fpkt"];
862--5079[label="1;95pkt 95fpkt"];
1354--3631[label="1;95pkt 95fpkt"];
1354--4575[label="1;95pkt 95fpkt"];
1354--5079[label="1;95pkt 95fpkt"];
3631--4575[label="1;147pkt 147fpkt"];
3631--5079[label="1;147pkt 147fpkt"];
4575--5079[label="1;147pkt 147fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="90.218.40.67" src_port="1032"/>
    </slice>
    <from sec="1041397805" usec="0"/>
    <to sec="1041397828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_194{
style=filled;
color=gray75;
234[label="61.82.80.69s;146pkt 146fpkt", shape=rectangle, color=red];
868[label="61.82.80.69s;146pkt 146fpkt", shape=ellipse, color=green];
stat194[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.82.80.69:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
234--868[label="1;146pkt 146fpkt"];
234--1514[label="0.938356;137pkt 137fpkt"];
868--1514[label="0.938356;137pkt 137fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.82.80.69" src_port="1028"/>
    </slice>
    <from sec="1041397516" usec="0"/>
    <to sec="1041397544" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_195{
style=filled;
color=gray75;
237[label="88.67.179.69s;211pkt 211fpkt", shape=rectangle, color=red];
870[label="88.67.179.69s;91pkt 91fpkt", shape=ellipse, color=green];
1360[label="88.67.179.69s;91pkt 91fpkt", shape=triangle, color=blue];
stat195[shape=component, label=&lt;Rules:&lt;BR/&gt;{88.67.179.69:64717, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 64717: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
237--870[label="1;91pkt 91fpkt"];
237--1360[label="1;91pkt 91fpkt"];
870--1360[label="1;91pkt 91fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="88.67.179.69" src_port="64717"/>
    </slice>
    <from sec="1041398034" usec="0"/>
    <to sec="1041398073" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_196{
style=filled;
color=gray75;
238[label="4.111.212.69s;198pkt 198fpkt", shape=rectangle, color=red];
871[label="4.111.212.69s;198pkt 198fpkt", shape=ellipse, color=green];
1361[label="4.111.212.69s;99pkt 99fpkt", shape=triangle, color=blue];
stat196[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.111.212.69:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
238--871[label="1;198pkt 198fpkt"];
238--1361[label="1;99pkt 99fpkt"];
871--1361[label="1;99pkt 99fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="4.111.212.69" src_port="1028"/>
    </slice>
    <from sec="1041398422" usec="0"/>
    <to sec="1041398451" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_197{
style=filled;
color=gray75;
240[label="101.127.13.71s;96pkt 96fpkt", shape=rectangle, color=red];
873[label="101.127.13.71s;96pkt 96fpkt", shape=ellipse, color=green];
stat197[shape=component, label=&lt;Rules:&lt;BR/&gt;{101.127.13.71:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
240--873[label="1;96pkt 96fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="101.127.13.71" src_port="1027"/>
    </slice>
    <from sec="1041397357" usec="0"/>
    <to sec="1041397372" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_198{
style=filled;
color=gray75;
242[label="4.207.196.72s;112pkt 112fpkt", shape=rectangle, color=red];
874[label="4.207.196.72s;112pkt 112fpkt", shape=ellipse, color=green];
stat198[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.207.196.72:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
242--874[label="1;112pkt 112fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="4.207.196.72" src_port="1025"/>
    </slice>
    <from sec="1041397753" usec="0"/>
    <to sec="1041397769" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_199{
style=filled;
color=gray75;
244[label="70.188.141.73s;70pkt 70fpkt", shape=rectangle, color=red];
875[label="70.188.141.73s;70pkt 70fpkt", shape=ellipse, color=green];
1362[label="70.188.141.73s;70pkt 70fpkt", shape=triangle, color=blue];
stat199[shape=component, label=&lt;Rules:&lt;BR/&gt;{70.188.141.73:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
244--875[label="1;70pkt 70fpkt"];
244--1362[label="1;70pkt 70fpkt"];
875--1362[label="1;70pkt 70fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="70.188.141.73" src_port="1028"/>
    </slice>
    <from sec="1041398358" usec="0"/>
    <to sec="1041398370" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.649115,1.85851,002,1 1 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_200{
style=filled;
color=gray75;
245[label="90.137.203.73s;128pkt 128fpkt", shape=rectangle, color=red];
876[label="90.137.203.73s;128pkt 128fpkt", shape=ellipse, color=green];
3664[label="90.137.203.73;140pkt 140fpkt", shape=pentagon, color=darkviolet];
stat200[shape=component, label=&lt;Rules:&lt;BR/&gt;{90.137.203.73:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
245--876[label="1;128pkt 128fpkt"];
245--1532[label="1;128pkt 128fpkt"];
245--3664[label="0.992188;127pkt 127fpkt"];
876--1532[label="1;128pkt 128fpkt"];
876--3664[label="0.992188;127pkt 127fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="90.137.203.73" src_port="1026"/>
    </slice>
    <from sec="1041397427" usec="0"/>
    <to sec="1041397456" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.770694,1.8419,002,1 1 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_201{
style=filled;
color=gray75;
247[label="217.53.146.75s;163pkt 163fpkt", shape=rectangle, color=red];
878[label="217.53.146.75s;163pkt 163fpkt", shape=ellipse, color=green];
3673[label="217.53.146.75;163pkt 163fpkt", shape=pentagon, color=darkviolet];
4592[label="217.53.146.75;163pkt 163fpkt", shape=invtriangle, color=brown];
stat201[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.53.146.75:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
247--878[label="1;163pkt 163fpkt"];
247--3673[label="1;163pkt 163fpkt"];
247--4592[label="1;163pkt 163fpkt"];
878--3673[label="1;163pkt 163fpkt"];
878--4592[label="1;163pkt 163fpkt"];
3673--4592[label="1;163pkt 163fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.53.146.75" src_port="1026"/>
    </slice>
    <from sec="1041398696" usec="0"/>
    <to sec="1041398729" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_202{
style=filled;
color=gray75;
248[label="90.76.167.75s;200pkt 200fpkt", shape=rectangle, color=red];
879[label="90.76.167.75s;110pkt 110fpkt", shape=ellipse, color=green];
1364[label="90.76.167.75s;110pkt 110fpkt", shape=triangle, color=blue];
3674[label="90.76.167.75;200pkt 200fpkt", shape=pentagon, color=darkviolet];
4593[label="90.76.167.75;200pkt 200fpkt", shape=invtriangle, color=brown];
5088[label="90.76.167.75;199pkt 199fpkt", shape=invhouse, color=bisque];
stat202[shape=component, label=&lt;Rules:&lt;BR/&gt;{90.76.167.75:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
248--879[label="1;110pkt 110fpkt"];
248--1364[label="1;110pkt 110fpkt"];
248--3674[label="1;200pkt 200fpkt"];
248--4593[label="1;200pkt 200fpkt"];
248--5088[label="1;199pkt 199fpkt"];
879--1364[label="1;110pkt 110fpkt"];
879--3674[label="1;110pkt 110fpkt"];
879--4593[label="1;110pkt 110fpkt"];
879--5088[label="1;110pkt 110fpkt"];
1364--3674[label="1;110pkt 110fpkt"];
1364--4593[label="1;110pkt 110fpkt"];
1364--5088[label="1;110pkt 110fpkt"];
3674--4593[label="1;200pkt 200fpkt"];
3674--5088[label="1;199pkt 199fpkt"];
4593--5088[label="1;199pkt 199fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="90.76.167.75" src_port="1027"/>
    </slice>
    <from sec="1041398117" usec="0"/>
    <to sec="1041398153" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_203{
style=filled;
color=gray75;
249[label="61.207.9.76s;109pkt 109fpkt", shape=rectangle, color=red];
880[label="61.207.9.76s;109pkt 109fpkt", shape=ellipse, color=green];
1365[label="61.207.9.76s;109pkt 109fpkt", shape=triangle, color=blue];
3675[label="61.207.9.76;125pkt 125fpkt", shape=pentagon, color=darkviolet];
stat203[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.207.9.76:1046, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1046: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
249--880[label="1;109pkt 109fpkt"];
249--1365[label="1;109pkt 109fpkt"];
249--3675[label="1;109pkt 109fpkt"];
880--1365[label="1;109pkt 109fpkt"];
880--3675[label="1;109pkt 109fpkt"];
1365--3675[label="1;109pkt 109fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.207.9.76" src_port="1046"/>
    </slice>
    <from sec="1041397855" usec="0"/>
    <to sec="1041397875" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_204{
style=filled;
color=gray75;
251[label="208.183.65.76s;62pkt 62fpkt", shape=rectangle, color=red];
881[label="208.183.65.76s;62pkt 62fpkt", shape=ellipse, color=green];
stat204[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.183.65.76:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
251--881[label="1;62pkt 62fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="208.183.65.76" src_port="1029"/>
    </slice>
    <from sec="1041397813" usec="0"/>
    <to sec="1041397827" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_205{
style=filled;
color=gray75;
253[label="217.35.18.78s;228pkt 228fpkt", shape=rectangle, color=red];
883[label="217.35.18.78s;172pkt 172fpkt", shape=ellipse, color=green];
1367[label="217.35.18.78s;71pkt 71fpkt", shape=triangle, color=blue];
3683[label="217.35.18.78;227pkt 227fpkt", shape=pentagon, color=darkviolet];
4597[label="217.35.18.78;227pkt 227fpkt", shape=invtriangle, color=brown];
stat205[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.35.18.78:1086, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1086: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
253--883[label="1;172pkt 172fpkt"];
253--1367[label="1;71pkt 71fpkt"];
253--3683[label="1;227pkt 227fpkt"];
253--4597[label="1;227pkt 227fpkt"];
883--1367[label="1;71pkt 71fpkt"];
883--3683[label="1;172pkt 172fpkt"];
883--4597[label="1;172pkt 172fpkt"];
1367--3683[label="1;71pkt 71fpkt"];
1367--4597[label="1;71pkt 71fpkt"];
3683--4597[label="1;227pkt 227fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.35.18.78" src_port="1086"/>
    </slice>
    <from sec="1041397998" usec="0"/>
    <to sec="1041398038" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_206{
style=filled;
color=gray75;
254[label="61.249.52.79s;209pkt 209fpkt", shape=rectangle, color=red];
884[label="61.249.52.79s;209pkt 209fpkt", shape=ellipse, color=green];
stat206[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.249.52.79:1030, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1030: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
254--884[label="1;209pkt 209fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.249.52.79" src_port="1030"/>
    </slice>
    <from sec="1041397531" usec="0"/>
    <to sec="1041397562" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_207{
style=filled;
color=gray75;
256[label="63.33.36.80s;132pkt 132fpkt", shape=rectangle, color=red];
886[label="63.33.36.80s;132pkt 132fpkt", shape=ellipse, color=green];
1369[label="63.33.36.80s;89pkt 89fpkt", shape=triangle, color=blue];
3689[label="63.33.36.80;131pkt 131fpkt", shape=pentagon, color=darkviolet];
stat207[shape=component, label=&lt;Rules:&lt;BR/&gt;{63.33.36.80:1033, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1033: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
256--886[label="1;132pkt 132fpkt"];
256--1369[label="1;89pkt 89fpkt"];
256--3689[label="1;131pkt 131fpkt"];
886--1369[label="1;89pkt 89fpkt"];
886--3689[label="1;131pkt 131fpkt"];
1369--3689[label="0.988764;88pkt 88fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="63.33.36.80" src_port="1033"/>
    </slice>
    <from sec="1041398683" usec="0"/>
    <to sec="1041398706" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_208{
style=filled;
color=gray75;
257[label="61.99.194.81s;105pkt 105fpkt", shape=rectangle, color=red];
887[label="61.99.194.81s;105pkt 105fpkt", shape=ellipse, color=green];
1370[label="61.99.194.81s;105pkt 105fpkt", shape=triangle, color=blue];
stat208[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.99.194.81:1025, *:137}[95.2381%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (47.619%)&lt;BR/&gt; 137: (47.619%)&lt;BR/&gt; 53: (4.7619%)&gt;];
}
257--887[label="1;105pkt 105fpkt"];
257--1370[label="1;105pkt 105fpkt"];
257--1638[label="0.00952381;1pkt 1fpkt"];
257--2037[label="0.00952381;1pkt 1fpkt"];
257--3274[label="0.00952381;1pkt 1fpkt"];
257--3278[label="0.00952381;1pkt 1fpkt"];
257--3282[label="0.00952381;1pkt 1fpkt"];
257--3287[label="0.00952381;1pkt 1fpkt"];
257--3288[label="0.00952381;1pkt 1fpkt"];
257--3293[label="0.00952381;1pkt 1fpkt"];
257--3296[label="0.00952381;1pkt 1fpkt"];
257--3297[label="0.00952381;1pkt 1fpkt"];
887--1370[label="1;105pkt 105fpkt"];
887--1638[label="0.00952381;1pkt 1fpkt"];
887--2037[label="0.00952381;1pkt 1fpkt"];
887--3274[label="0.00952381;1pkt 1fpkt"];
887--3278[label="0.00952381;1pkt 1fpkt"];
887--3282[label="0.00952381;1pkt 1fpkt"];
887--3287[label="0.00952381;1pkt 1fpkt"];
887--3288[label="0.00952381;1pkt 1fpkt"];
887--3293[label="0.00952381;1pkt 1fpkt"];
887--3296[label="0.00952381;1pkt 1fpkt"];
887--3297[label="0.00952381;1pkt 1fpkt"];
1370--1638[label="0.00952381;1pkt 1fpkt"];
1370--2037[label="0.00952381;1pkt 1fpkt"];
1370--3274[label="0.00952381;1pkt 1fpkt"];
1370--3278[label="0.00952381;1pkt 1fpkt"];
1370--3282[label="0.00952381;1pkt 1fpkt"];
1370--3287[label="0.00952381;1pkt 1fpkt"];
1370--3288[label="0.00952381;1pkt 1fpkt"];
1370--3293[label="0.00952381;1pkt 1fpkt"];
1370--3296[label="0.00952381;1pkt 1fpkt"];
1370--3297[label="0.00952381;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.99.194.81" src_port="1025"/>
    </slice>
    <from sec="1041397515" usec="0"/>
    <to sec="1041397532" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_209{
style=filled;
color=gray75;
258[label="61.167.39.82s;224pkt 224fpkt", shape=rectangle, color=red];
888[label="61.167.39.82s;163pkt 163fpkt", shape=ellipse, color=green];
1371[label="61.167.39.82s;88pkt 88fpkt", shape=triangle, color=blue];
3697[label="61.167.39.82;246pkt 246fpkt", shape=pentagon, color=darkviolet];
4604[label="61.167.39.82;247pkt 247fpkt", shape=invtriangle, color=brown];
5094[label="61.167.39.82;246pkt 246fpkt", shape=invhouse, color=bisque];
stat209[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.167.39.82:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
258--888[label="1;163pkt 163fpkt"];
258--1371[label="1;88pkt 88fpkt"];
258--3697[label="0.995536;223pkt 223fpkt"];
258--4604[label="1;224pkt 224fpkt"];
258--5094[label="0.995536;223pkt 223fpkt"];
888--1371[label="1;88pkt 88fpkt"];
888--3697[label="0.993865;162pkt 162fpkt"];
888--4604[label="1;163pkt 163fpkt"];
888--5094[label="0.993865;162pkt 162fpkt"];
1371--3697[label="1;88pkt 88fpkt"];
1371--4604[label="1;88pkt 88fpkt"];
1371--5094[label="1;88pkt 88fpkt"];
3697--4604[label="1;246pkt 246fpkt"];
3697--5094[label="1;246pkt 246fpkt"];
4604--5094[label="1;246pkt 246fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.167.39.82" src_port="1025"/>
    </slice>
    <from sec="1041397889" usec="0"/>
    <to sec="1041397941" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.02037,1.88019,002,1 1 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_210{
style=filled;
color=gray75;
264[label="70.107.80.84s;159pkt 159fpkt", shape=rectangle, color=red];
892[label="70.107.80.84s;106pkt 106fpkt", shape=ellipse, color=green];
3709[label="70.107.80.84;172pkt 172fpkt", shape=pentagon, color=darkviolet];
4612[label="70.107.80.84;172pkt 172fpkt", shape=invtriangle, color=brown];
5099[label="70.107.80.84;172pkt 172fpkt", shape=invhouse, color=bisque];
stat210[shape=component, label=&lt;Rules:&lt;BR/&gt;{70.107.80.84:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
264--892[label="1;106pkt 106fpkt"];
264--3709[label="0.993711;158pkt 158fpkt"];
264--4612[label="0.993711;158pkt 158fpkt"];
264--5099[label="0.993711;158pkt 158fpkt"];
892--3709[label="0.990566;105pkt 105fpkt"];
892--4612[label="0.990566;105pkt 105fpkt"];
892--5099[label="0.990566;105pkt 105fpkt"];
3709--4612[label="1;172pkt 172fpkt"];
3709--5099[label="1;172pkt 172fpkt"];
4612--5099[label="1;172pkt 172fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="70.107.80.84" src_port="1025"/>
    </slice>
    <from sec="1041397545" usec="0"/>
    <to sec="1041397571" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_211{
style=filled;
color=gray75;
269[label="165.144.154.87s;222pkt 222fpkt", shape=rectangle, color=red];
895[label="165.144.154.87s;222pkt 222fpkt", shape=ellipse, color=green];
1374[label="165.144.154.87s;222pkt 222fpkt", shape=triangle, color=blue];
3720[label="165.144.154.87;255pkt 255fpkt", shape=pentagon, color=darkviolet];
4617[label="165.144.154.87;255pkt 255fpkt", shape=invtriangle, color=brown];
5102[label="165.144.154.87;255pkt 255fpkt", shape=invhouse, color=bisque];
stat211[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.144.154.87:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
269--895[label="1;222pkt 222fpkt"];
269--1374[label="1;222pkt 222fpkt"];
269--3720[label="0.995495;221pkt 221fpkt"];
269--4617[label="0.995495;221pkt 221fpkt"];
269--5102[label="0.995495;221pkt 221fpkt"];
895--1374[label="1;222pkt 222fpkt"];
895--3720[label="0.995495;221pkt 221fpkt"];
895--4617[label="0.995495;221pkt 221fpkt"];
895--5102[label="0.995495;221pkt 221fpkt"];
1374--3720[label="0.995495;221pkt 221fpkt"];
1374--4617[label="0.995495;221pkt 221fpkt"];
1374--5102[label="0.995495;221pkt 221fpkt"];
3720--4617[label="1;255pkt 255fpkt"];
3720--5102[label="1;255pkt 255fpkt"];
4617--5102[label="1;255pkt 255fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="165.144.154.87" src_port="1029"/>
    </slice>
    <from sec="1041397825" usec="0"/>
    <to sec="1041397843" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_212{
style=filled;
color=gray75;
273[label="4.210.132.89s;234pkt 234fpkt", shape=rectangle, color=red];
899[label="4.210.132.89s;234pkt 234fpkt", shape=ellipse, color=green];
1377[label="4.210.132.89s;227pkt 227fpkt", shape=triangle, color=blue];
3731[label="4.210.132.89;232pkt 232fpkt", shape=pentagon, color=darkviolet];
stat212[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.210.132.89:1048, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1048: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
273--899[label="1;234pkt 234fpkt"];
273--1377[label="1;227pkt 227fpkt"];
273--3276[label="0.688034;161pkt 161fpkt"];
273--3290[label="0.688034;161pkt 161fpkt"];
273--3299[label="0.688034;161pkt 161fpkt"];
273--3731[label="1;232pkt 232fpkt"];
899--1377[label="1;227pkt 227fpkt"];
899--3276[label="0.688034;161pkt 161fpkt"];
899--3290[label="0.688034;161pkt 161fpkt"];
899--3299[label="0.688034;161pkt 161fpkt"];
899--3731[label="1;232pkt 232fpkt"];
1377--3276[label="0.678414;154pkt 154fpkt"];
1377--3290[label="0.678414;154pkt 154fpkt"];
1377--3299[label="0.678414;154pkt 154fpkt"];
1377--3731[label="0.995595;226pkt 226fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="4.210.132.89" src_port="1048"/>
    </slice>
    <from sec="1041397222" usec="0"/>
    <to sec="1041397258" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.649115,1.85851,002,1 1 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_213{
style=filled;
color=gray75;
274[label="217.33.37.90s;86pkt 86fpkt", shape=rectangle, color=red];
900[label="217.33.37.90s;86pkt 86fpkt", shape=ellipse, color=green];
3732[label="217.33.37.90;118pkt 118fpkt", shape=pentagon, color=darkviolet];
stat213[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.33.37.90:1107, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1107: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
274--900[label="1;86pkt 86fpkt"];
274--3732[label="1;86pkt 86fpkt"];
900--3732[label="1;86pkt 86fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.33.37.90" src_port="1107"/>
    </slice>
    <from sec="1041397308" usec="0"/>
    <to sec="1041397327" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_214{
style=filled;
color=gray75;
276[label="89.32.174.90s;220pkt 220fpkt", shape=rectangle, color=red];
902[label="89.32.174.90s;220pkt 220fpkt", shape=ellipse, color=green];
1379[label="89.32.174.90s;220pkt 220fpkt", shape=triangle, color=blue];
3735[label="89.32.174.90;235pkt 235fpkt", shape=pentagon, color=darkviolet];
4625[label="89.32.174.90;235pkt 235fpkt", shape=invtriangle, color=brown];
5106[label="89.32.174.90;235pkt 235fpkt", shape=invhouse, color=bisque];
stat214[shape=component, label=&lt;Rules:&lt;BR/&gt;{89.32.174.90:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
276--902[label="1;220pkt 220fpkt"];
276--1379[label="1;220pkt 220fpkt"];
276--3735[label="1;220pkt 220fpkt"];
276--4625[label="1;220pkt 220fpkt"];
276--5106[label="1;220pkt 220fpkt"];
902--1379[label="1;220pkt 220fpkt"];
902--3735[label="1;220pkt 220fpkt"];
902--4625[label="1;220pkt 220fpkt"];
902--5106[label="1;220pkt 220fpkt"];
1379--3735[label="1;220pkt 220fpkt"];
1379--4625[label="1;220pkt 220fpkt"];
1379--5106[label="1;220pkt 220fpkt"];
3735--4625[label="1;235pkt 235fpkt"];
3735--5106[label="1;235pkt 235fpkt"];
4625--5106[label="1;235pkt 235fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="89.32.174.90" src_port="1025"/>
    </slice>
    <from sec="1041397736" usec="0"/>
    <to sec="1041397772" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.649115,1.85851,002,1 1 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_215{
style=filled;
color=gray75;
277[label="211.219.25.91s;232pkt 232fpkt", shape=rectangle, color=red];
903[label="211.219.25.91s;211pkt 211fpkt", shape=ellipse, color=green];
3738[label="211.219.25.91;231pkt 231fpkt", shape=pentagon, color=darkviolet];
stat215[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.219.25.91:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
277--903[label="1;211pkt 211fpkt"];
277--3738[label="1;231pkt 231fpkt"];
903--3738[label="1;211pkt 211fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="211.219.25.91" src_port="1028"/>
    </slice>
    <from sec="1041397925" usec="0"/>
    <to sec="1041397962" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_216{
style=filled;
color=gray75;
278[label="61.176.133.91s;147pkt 147fpkt", shape=rectangle, color=red];
904[label="61.176.133.91s;147pkt 147fpkt", shape=ellipse, color=green];
1380[label="61.176.133.91s;109pkt 109fpkt", shape=triangle, color=blue];
stat216[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.176.133.91:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
278--904[label="1;147pkt 147fpkt"];
278--1380[label="1;109pkt 109fpkt"];
904--1380[label="1;109pkt 109fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.176.133.91" src_port="1028"/>
    </slice>
    <from sec="1041398315" usec="0"/>
    <to sec="1041398338" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.649115,1.85851,002,1 1 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_217{
style=filled;
color=gray75;
279[label="62.215.23.93s;168pkt 168fpkt", shape=rectangle, color=red];
905[label="62.215.23.93s;168pkt 168fpkt", shape=ellipse, color=green];
3744[label="62.215.23.93;174pkt 174fpkt", shape=pentagon, color=darkviolet];
stat217[shape=component, label=&lt;Rules:&lt;BR/&gt;{62.215.23.93:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
279--905[label="1;168pkt 168fpkt"];
279--3744[label="0.994048;167pkt 167fpkt"];
905--3744[label="0.994048;167pkt 167fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="62.215.23.93" src_port="1027"/>
    </slice>
    <from sec="1041398334" usec="0"/>
    <to sec="1041398361" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832101,1.85471,002,1 0 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_218{
style=filled;
color=gray75;
281[label="88.126.199.93s;165pkt 165fpkt", shape=rectangle, color=red];
1381[label="88.126.199.93s;79pkt 79fpkt", shape=triangle, color=blue];
3746[label="88.126.199.93;164pkt 164fpkt", shape=pentagon, color=darkviolet];
4631[label="88.126.199.93;164pkt 164fpkt", shape=invtriangle, color=brown];
stat218[shape=component, label=&lt;Rules:&lt;BR/&gt;{88.126.199.93:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
281--906[label="1;79pkt 79fpkt"];
281--1381[label="1;79pkt 79fpkt"];
281--3280[label="0.0787879;13pkt 13fpkt"];
281--3295[label="0.0787879;13pkt 13fpkt"];
281--3746[label="1;164pkt 164fpkt"];
281--4631[label="1;164pkt 164fpkt"];
1381--3280[label="0.164557;13pkt 13fpkt"];
1381--3295[label="0.164557;13pkt 13fpkt"];
1381--3746[label="0.987342;78pkt 78fpkt"];
1381--4631[label="0.987342;78pkt 78fpkt"];
3746--4631[label="1;164pkt 164fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="88.126.199.93" src_port="1025"/>
    </slice>
    <from sec="1041398436" usec="0"/>
    <to sec="1041398462" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_219{
style=filled;
color=gray75;
283[label="217.129.128.94s;117pkt 117fpkt", shape=rectangle, color=red];
908[label="217.129.128.94s;117pkt 117fpkt", shape=ellipse, color=green];
1382[label="217.129.128.94s;117pkt 117fpkt", shape=triangle, color=blue];
3748[label="217.129.128.94;117pkt 117fpkt", shape=pentagon, color=darkviolet];
4632[label="217.129.128.94;116pkt 116fpkt", shape=invtriangle, color=brown];
stat219[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.129.128.94:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
283--908[label="1;117pkt 117fpkt"];
283--1382[label="1;117pkt 117fpkt"];
283--3748[label="1;117pkt 117fpkt"];
283--4632[label="1;116pkt 116fpkt"];
908--1382[label="1;117pkt 117fpkt"];
908--3748[label="1;117pkt 117fpkt"];
908--4632[label="1;116pkt 116fpkt"];
1382--3748[label="1;117pkt 117fpkt"];
1382--4632[label="1;116pkt 116fpkt"];
3748--4632[label="1;116pkt 116fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.129.128.94" src_port="1025"/>
    </slice>
    <from sec="1041397553" usec="0"/>
    <to sec="1041397573" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_220{
style=filled;
color=gray75;
284[label="61.163.182.94s;162pkt 162fpkt", shape=rectangle, color=red];
909[label="61.163.182.94s;162pkt 162fpkt", shape=ellipse, color=green];
1383[label="61.163.182.94s;67pkt 67fpkt", shape=triangle, color=blue];
stat220[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.163.182.94:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
284--909[label="1;162pkt 162fpkt"];
284--1383[label="1;67pkt 67fpkt"];
909--1383[label="1;67pkt 67fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.163.182.94" src_port="1025"/>
    </slice>
    <from sec="1041397962" usec="0"/>
    <to sec="1041397989" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_221{
style=filled;
color=gray75;
287[label="4.210.150.96s;206pkt 206fpkt", shape=rectangle, color=red];
912[label="4.210.150.96s;206pkt 206fpkt", shape=ellipse, color=green];
1386[label="4.210.150.96s;114pkt 114fpkt", shape=triangle, color=blue];
3753[label="4.210.150.96;227pkt 227fpkt", shape=pentagon, color=darkviolet];
4636[label="4.210.150.96;228pkt 228fpkt", shape=invtriangle, color=brown];
5113[label="4.210.150.96;227pkt 227fpkt", shape=invhouse, color=bisque];
stat221[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.210.150.96:1034, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1034: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
287--912[label="1;206pkt 206fpkt"];
287--1386[label="1;114pkt 114fpkt"];
287--3753[label="0.995146;205pkt 205fpkt"];
287--4636[label="1;206pkt 206fpkt"];
287--5113[label="0.995146;205pkt 205fpkt"];
912--1386[label="1;114pkt 114fpkt"];
912--3753[label="0.995146;205pkt 205fpkt"];
912--4636[label="1;206pkt 206fpkt"];
912--5113[label="0.995146;205pkt 205fpkt"];
1386--3753[label="1;114pkt 114fpkt"];
1386--4636[label="1;114pkt 114fpkt"];
1386--5113[label="1;114pkt 114fpkt"];
3753--4636[label="1;227pkt 227fpkt"];
3753--5113[label="1;227pkt 227fpkt"];
4636--5113[label="1;227pkt 227fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="4.210.150.96" src_port="1034"/>
    </slice>
    <from sec="1041398140" usec="0"/>
    <to sec="1041398178" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_222{
style=filled;
color=gray75;
290[label="210.47.1.98s;164pkt 164fpkt", shape=rectangle, color=red];
914[label="210.47.1.98s;72pkt 72fpkt", shape=ellipse, color=green];
1388[label="210.47.1.98s;72pkt 72fpkt", shape=triangle, color=blue];
3762[label="210.47.1.98;163pkt 163fpkt", shape=pentagon, color=darkviolet];
4640[label="210.47.1.98;164pkt 164fpkt", shape=invtriangle, color=brown];
stat222[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.47.1.98:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
290--914[label="1;72pkt 72fpkt"];
290--1388[label="1;72pkt 72fpkt"];
290--3762[label="1;163pkt 163fpkt"];
290--4640[label="1;164pkt 164fpkt"];
914--1388[label="1;72pkt 72fpkt"];
914--3762[label="0.986111;71pkt 71fpkt"];
914--4640[label="1;72pkt 72fpkt"];
1388--3762[label="0.986111;71pkt 71fpkt"];
1388--4640[label="1;72pkt 72fpkt"];
3762--4640[label="1;163pkt 163fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="210.47.1.98" src_port="1026"/>
    </slice>
    <from sec="1041398144" usec="0"/>
    <to sec="1041398174" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.770694,1.8419,002,1 1 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_223{
style=filled;
color=gray75;
292[label="211.57.42.99s;250pkt 250fpkt", shape=rectangle, color=red];
915[label="211.57.42.99s;186pkt 186fpkt", shape=ellipse, color=green];
3768[label="211.57.42.99;249pkt 249fpkt", shape=pentagon, color=darkviolet];
4642[label="211.57.42.99;250pkt 250fpkt", shape=invtriangle, color=brown];
stat223[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.57.42.99:1024, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1024: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
292--915[label="1;186pkt 186fpkt"];
292--3768[label="1;249pkt 249fpkt"];
292--4642[label="1;250pkt 250fpkt"];
915--3768[label="0.994624;185pkt 185fpkt"];
915--4642[label="1;186pkt 186fpkt"];
3768--4642[label="1;249pkt 249fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="211.57.42.99" src_port="1024"/>
    </slice>
    <from sec="1041397316" usec="0"/>
    <to sec="1041397358" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_224{
style=filled;
color=gray75;
293[label="63.31.70.99s;79pkt 79fpkt", shape=rectangle, color=red];
916[label="63.31.70.99s;79pkt 79fpkt", shape=ellipse, color=green];
1389[label="63.31.70.99s;79pkt 79fpkt", shape=triangle, color=blue];
stat224[shape=component, label=&lt;Rules:&lt;BR/&gt;{63.31.70.99:1031, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1031: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
293--916[label="1;79pkt 79fpkt"];
293--1389[label="1;79pkt 79fpkt"];
916--1389[label="1;79pkt 79fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="63.31.70.99" src_port="1031"/>
    </slice>
    <from sec="1041398650" usec="0"/>
    <to sec="1041398663" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_225{
style=filled;
color=gray75;
296[label="70.11.210.101s;208pkt 208fpkt", shape=rectangle, color=red];
919[label="70.11.210.101s;208pkt 208fpkt", shape=ellipse, color=green];
1391[label="70.11.210.101s;175pkt 175fpkt", shape=triangle, color=blue];
stat225[shape=component, label=&lt;Rules:&lt;BR/&gt;{70.11.210.101:1032, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1032: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
296--919[label="1;208pkt 208fpkt"];
296--1391[label="1;175pkt 175fpkt"];
919--1391[label="1;175pkt 175fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="70.11.210.101" src_port="1032"/>
    </slice>
    <from sec="1041397488" usec="0"/>
    <to sec="1041397520" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_226{
style=filled;
color=gray75;
298[label="70.160.209.102s;78pkt 78fpkt", shape=rectangle, color=red];
920[label="70.160.209.102s;78pkt 78fpkt", shape=ellipse, color=green];
1392[label="70.160.209.102s;78pkt 78fpkt", shape=triangle, color=blue];
stat226[shape=component, label=&lt;Rules:&lt;BR/&gt;{70.160.209.102:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
298--920[label="1;78pkt 78fpkt"];
298--1392[label="1;78pkt 78fpkt"];
920--1392[label="1;78pkt 78fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="70.160.209.102" src_port="1026"/>
    </slice>
    <from sec="1041398375" usec="0"/>
    <to sec="1041398388" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_227{
style=filled;
color=gray75;
299[label="217.94.217.102s;171pkt 171fpkt", shape=rectangle, color=red];
921[label="217.94.217.102s;171pkt 171fpkt", shape=ellipse, color=green];
1393[label="217.94.217.102s;171pkt 171fpkt", shape=triangle, color=blue];
stat227[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.94.217.102:1064, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1064: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
299--921[label="1;171pkt 171fpkt"];
299--1393[label="1;171pkt 171fpkt"];
921--1393[label="1;171pkt 171fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.94.217.102" src_port="1064"/>
    </slice>
    <from sec="1041398253" usec="0"/>
    <to sec="1041398281" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_228{
style=filled;
color=gray75;
300[label="61.163.8.103s;130pkt 130fpkt", shape=rectangle, color=red];
922[label="61.163.8.103s;82pkt 82fpkt", shape=ellipse, color=green];
1394[label="61.163.8.103s;82pkt 82fpkt", shape=triangle, color=blue];
3784[label="61.163.8.103;129pkt 129fpkt", shape=pentagon, color=darkviolet];
4652[label="61.163.8.103;130pkt 130fpkt", shape=invtriangle, color=brown];
5118[label="61.163.8.103;129pkt 129fpkt", shape=invhouse, color=bisque];
stat228[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.163.8.103:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
300--922[label="1;82pkt 82fpkt"];
300--1394[label="1;82pkt 82fpkt"];
300--3784[label="1;129pkt 129fpkt"];
300--4652[label="1;130pkt 130fpkt"];
300--5118[label="1;129pkt 129fpkt"];
922--1394[label="1;82pkt 82fpkt"];
922--3784[label="1;82pkt 82fpkt"];
922--4652[label="1;82pkt 82fpkt"];
922--5118[label="1;82pkt 82fpkt"];
1394--3784[label="1;82pkt 82fpkt"];
1394--4652[label="1;82pkt 82fpkt"];
1394--5118[label="1;82pkt 82fpkt"];
3784--4652[label="1;129pkt 129fpkt"];
3784--5118[label="1;129pkt 129fpkt"];
4652--5118[label="1;129pkt 129fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.163.8.103" src_port="1025"/>
    </slice>
    <from sec="1041398603" usec="0"/>
    <to sec="1041398624" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_229{
style=filled;
color=gray75;
301[label="217.69.61.103s;167pkt 167fpkt", shape=rectangle, color=red];
923[label="217.69.61.103s;167pkt 167fpkt", shape=ellipse, color=green];
1395[label="217.69.61.103s;167pkt 167fpkt", shape=triangle, color=blue];
stat229[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.69.61.103:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
301--923[label="1;167pkt 167fpkt"];
301--1395[label="1;167pkt 167fpkt"];
923--1395[label="1;167pkt 167fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.69.61.103" src_port="1026"/>
    </slice>
    <from sec="1041397781" usec="0"/>
    <to sec="1041397807" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_230{
style=filled;
color=gray75;
302[label="61.98.176.103s;247pkt 247fpkt", shape=rectangle, color=red];
924[label="61.98.176.103s;247pkt 247fpkt", shape=ellipse, color=green];
1396[label="61.98.176.103s;119pkt 119fpkt", shape=triangle, color=blue];
3785[label="61.98.176.103;247pkt 247fpkt", shape=pentagon, color=darkviolet];
4653[label="61.98.176.103;247pkt 247fpkt", shape=invtriangle, color=brown];
stat230[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.98.176.103:1031, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1031: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
302--924[label="1;247pkt 247fpkt"];
302--1396[label="1;119pkt 119fpkt"];
302--3785[label="1;247pkt 247fpkt"];
302--4653[label="1;247pkt 247fpkt"];
924--1396[label="1;119pkt 119fpkt"];
924--3785[label="1;247pkt 247fpkt"];
924--4653[label="1;247pkt 247fpkt"];
1396--3785[label="1;119pkt 119fpkt"];
1396--4653[label="1;119pkt 119fpkt"];
3785--4653[label="1;247pkt 247fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.98.176.103" src_port="1031"/>
    </slice>
    <from sec="1041397266" usec="0"/>
    <to sec="1041397306" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_231{
style=filled;
color=gray75;
303[label="200.28.186.104s;145pkt 145fpkt", shape=rectangle, color=red];
925[label="200.28.186.104s;145pkt 145fpkt", shape=ellipse, color=green];
1397[label="200.28.186.104s;145pkt 145fpkt", shape=triangle, color=blue];
stat231[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.28.186.104:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
303--925[label="1;145pkt 145fpkt"];
303--1397[label="1;145pkt 145fpkt"];
925--1397[label="1;145pkt 145fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="200.28.186.104" src_port="1025"/>
    </slice>
    <from sec="1041398228" usec="0"/>
    <to sec="1041398250" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_232{
style=filled;
color=gray75;
304[label="61.142.1.105s;98pkt 98fpkt", shape=rectangle, color=red];
926[label="61.142.1.105s;66pkt 66fpkt", shape=ellipse, color=green];
stat232[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.142.1.105:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
304--926[label="1;66pkt 66fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.142.1.105" src_port="1027"/>
    </slice>
    <from sec="1041397457" usec="0"/>
    <to sec="1041397482" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_233{
style=filled;
color=gray75;
305[label="218.201.85.105s;137pkt 137fpkt", shape=rectangle, color=red];
927[label="218.201.85.105s;137pkt 137fpkt", shape=ellipse, color=green];
stat233[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.201.85.105:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
305--927[label="1;137pkt 137fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="218.201.85.105" src_port="1025"/>
    </slice>
    <from sec="1041397817" usec="0"/>
    <to sec="1041397838" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.649115,1.85851,002,1 1 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_234{
style=filled;
color=gray75;
307[label="61.249.228.107s;163pkt 163fpkt", shape=rectangle, color=red];
929[label="61.249.228.107s;163pkt 163fpkt", shape=ellipse, color=green];
3804[label="61.249.228.107;163pkt 163fpkt", shape=pentagon, color=darkviolet];
stat234[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.249.228.107:1024, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1024: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
307--929[label="1;163pkt 163fpkt"];
307--3804[label="1;163pkt 163fpkt"];
929--3804[label="1;163pkt 163fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.249.228.107" src_port="1024"/>
    </slice>
    <from sec="1041398682" usec="0"/>
    <to sec="1041398708" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_235{
style=filled;
color=gray75;
310[label="211.57.128.108s;256pkt 256fpkt", shape=rectangle, color=red];
931[label="211.57.128.108s;256pkt 256fpkt", shape=ellipse, color=green];
1400[label="211.57.128.108s;256pkt 256fpkt", shape=triangle, color=blue];
stat235[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.57.128.108:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
310--931[label="1;256pkt 256fpkt"];
310--1400[label="1;256pkt 256fpkt"];
931--1400[label="1;256pkt 256fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="211.57.128.108" src_port="1027"/>
    </slice>
    <from sec="1041398415" usec="0"/>
    <to sec="1041398435" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_236{
style=filled;
color=gray75;
311[label="216.241.145.108s;242pkt 242fpkt", shape=rectangle, color=red];
932[label="216.241.145.108s;201pkt 201fpkt", shape=ellipse, color=green];
1401[label="216.241.145.108s;201pkt 201fpkt", shape=triangle, color=blue];
3806[label="216.241.145.108;241pkt 241fpkt", shape=pentagon, color=darkviolet];
4664[label="216.241.145.108;242pkt 242fpkt", shape=invtriangle, color=brown];
stat236[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.241.145.108:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
311--932[label="1;201pkt 201fpkt"];
311--1401[label="1;201pkt 201fpkt"];
311--3806[label="1;241pkt 241fpkt"];
311--4664[label="1;242pkt 242fpkt"];
932--1401[label="1;201pkt 201fpkt"];
932--3806[label="0.995025;200pkt 200fpkt"];
932--4664[label="1;201pkt 201fpkt"];
1401--3806[label="0.995025;200pkt 200fpkt"];
1401--4664[label="1;201pkt 201fpkt"];
3806--4664[label="1;241pkt 241fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="216.241.145.108" src_port="1027"/>
    </slice>
    <from sec="1041397707" usec="0"/>
    <to sec="1041397746" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_237{
style=filled;
color=gray75;
312[label="63.17.178.108s;146pkt 146fpkt", shape=rectangle, color=red];
933[label="63.17.178.108s;146pkt 146fpkt", shape=ellipse, color=green];
1402[label="63.17.178.108s;83pkt 83fpkt", shape=triangle, color=blue];
stat237[shape=component, label=&lt;Rules:&lt;BR/&gt;{63.17.178.108:1024, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1024: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
312--933[label="1;146pkt 146fpkt"];
312--1402[label="1;83pkt 83fpkt"];
933--1402[label="1;83pkt 83fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="63.17.178.108" src_port="1024"/>
    </slice>
    <from sec="1041398574" usec="0"/>
    <to sec="1041398597" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_238{
style=filled;
color=gray75;
314[label="61.161.135.109s;237pkt 237fpkt", shape=rectangle, color=red];
934[label="61.161.135.109s;237pkt 237fpkt", shape=ellipse, color=green];
1403[label="61.161.135.109s;172pkt 172fpkt", shape=triangle, color=blue];
stat238[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.161.135.109:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
314--934[label="1;237pkt 237fpkt"];
314--1403[label="1;172pkt 172fpkt"];
934--1403[label="1;172pkt 172fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.161.135.109" src_port="1026"/>
    </slice>
    <from sec="1041397252" usec="0"/>
    <to sec="1041397291" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_239{
style=filled;
color=gray75;
315[label="212.161.144.109s;71pkt 71fpkt", shape=rectangle, color=red];
935[label="212.161.144.109s;71pkt 71fpkt", shape=ellipse, color=green];
1404[label="212.161.144.109s;71pkt 71fpkt", shape=triangle, color=blue];
stat239[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.161.144.109:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
315--935[label="1;71pkt 71fpkt"];
315--1404[label="1;71pkt 71fpkt"];
315--3285[label="1;71pkt 71fpkt"];
935--1404[label="1;71pkt 71fpkt"];
935--3285[label="1;71pkt 71fpkt"];
1404--3285[label="1;71pkt 71fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="212.161.144.109" src_port="1026"/>
    </slice>
    <from sec="1041398765" usec="0"/>
    <to sec="1041398777" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_240{
style=filled;
color=gray75;
42[label="90.186.35.110s;224pkt 224fpkt", shape=rectangle, color=red];
936[label="90.186.35.110s;224pkt 224fpkt", shape=ellipse, color=green];
1405[label="90.186.35.110s;118pkt 118fpkt", shape=triangle, color=blue];
3813[label="90.186.35.110;241pkt 241fpkt", shape=pentagon, color=darkviolet];
4668[label="90.186.35.110;241pkt 241fpkt", shape=invtriangle, color=brown];
5126[label="90.186.35.110;242pkt 242fpkt", shape=invhouse, color=bisque];
stat240[shape=component, label=&lt;Rules:&lt;BR/&gt;{90.186.35.110:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
42--936[label="1;224pkt 224fpkt"];
42--1405[label="1;118pkt 118fpkt"];
42--3813[label="0.995536;223pkt 223fpkt"];
42--4668[label="0.995536;223pkt 223fpkt"];
42--5126[label="1;224pkt 224fpkt"];
936--1405[label="1;118pkt 118fpkt"];
936--3813[label="0.995536;223pkt 223fpkt"];
936--4668[label="0.995536;223pkt 223fpkt"];
936--5126[label="1;224pkt 224fpkt"];
1405--3813[label="1;118pkt 118fpkt"];
1405--4668[label="1;118pkt 118fpkt"];
1405--5126[label="1;118pkt 118fpkt"];
3813--4668[label="1;241pkt 241fpkt"];
3813--5126[label="1;241pkt 241fpkt"];
4668--5126[label="1;241pkt 241fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="90.186.35.110" src_port="1027"/>
    </slice>
    <from sec="1041397280" usec="0"/>
    <to sec="1041397318" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_241{
style=filled;
color=gray75;
317[label="93.181.133.112s;87pkt 87fpkt", shape=rectangle, color=red];
937[label="93.181.133.112s;87pkt 87fpkt", shape=ellipse, color=green];
1406[label="93.181.133.112s;87pkt 87fpkt", shape=triangle, color=blue];
3821[label="93.181.133.112;100pkt 100fpkt", shape=pentagon, color=darkviolet];
4670[label="93.181.133.112;100pkt 100fpkt", shape=invtriangle, color=brown];
stat241[shape=component, label=&lt;Rules:&lt;BR/&gt;{93.181.133.112:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
317--937[label="1;87pkt 87fpkt"];
317--1406[label="1;87pkt 87fpkt"];
317--3821[label="1;87pkt 87fpkt"];
317--4670[label="1;87pkt 87fpkt"];
937--1406[label="1;87pkt 87fpkt"];
937--3821[label="1;87pkt 87fpkt"];
937--4670[label="1;87pkt 87fpkt"];
1406--3821[label="1;87pkt 87fpkt"];
1406--4670[label="1;87pkt 87fpkt"];
3821--4670[label="1;100pkt 100fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="93.181.133.112" src_port="1026"/>
    </slice>
    <from sec="1041397947" usec="0"/>
    <to sec="1041397979" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_242{
style=filled;
color=gray75;
318[label="62.248.226.112s;236pkt 236fpkt", shape=rectangle, color=red];
938[label="62.248.226.112s;236pkt 236fpkt", shape=ellipse, color=green];
1407[label="62.248.226.112s;236pkt 236fpkt", shape=triangle, color=blue];
stat242[shape=component, label=&lt;Rules:&lt;BR/&gt;{62.248.226.112:1033, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1033: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
318--938[label="1;236pkt 236fpkt"];
318--1407[label="1;236pkt 236fpkt"];
938--1407[label="1;236pkt 236fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="62.248.226.112" src_port="1033"/>
    </slice>
    <from sec="1041398293" usec="0"/>
    <to sec="1041398331" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_243{
style=filled;
color=gray75;
319[label="202.83.227.112s;89pkt 89fpkt", shape=rectangle, color=red];
939[label="202.83.227.112s;89pkt 89fpkt", shape=ellipse, color=green];
1408[label="202.83.227.112s;89pkt 89fpkt", shape=triangle, color=blue];
3824[label="202.83.227.112;151pkt 151fpkt", shape=pentagon, color=darkviolet];
4672[label="202.83.227.112;151pkt 151fpkt", shape=invtriangle, color=brown];
stat243[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.83.227.112:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
319--939[label="1;89pkt 89fpkt"];
319--1408[label="1;89pkt 89fpkt"];
319--3824[label="1;89pkt 89fpkt"];
319--4672[label="1;89pkt 89fpkt"];
939--1408[label="1;89pkt 89fpkt"];
939--3824[label="1;89pkt 89fpkt"];
939--4672[label="1;89pkt 89fpkt"];
1408--3824[label="1;89pkt 89fpkt"];
1408--4672[label="1;89pkt 89fpkt"];
3824--4672[label="1;151pkt 151fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="202.83.227.112" src_port="1025"/>
    </slice>
    <from sec="1041398685" usec="0"/>
    <to sec="1041398712" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_244{
style=filled;
color=gray75;
320[label="217.34.15.113s;135pkt 135fpkt", shape=rectangle, color=red];
940[label="217.34.15.113s;135pkt 135fpkt", shape=ellipse, color=green];
1409[label="217.34.15.113s;75pkt 75fpkt", shape=triangle, color=blue];
3826[label="217.34.15.113;135pkt 135fpkt", shape=pentagon, color=darkviolet];
stat244[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.34.15.113:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
320--940[label="1;135pkt 135fpkt"];
320--1409[label="1;75pkt 75fpkt"];
320--3276[label="1;135pkt 135fpkt"];
320--3290[label="1;135pkt 135fpkt"];
320--3299[label="1;135pkt 135fpkt"];
320--3826[label="1;135pkt 135fpkt"];
940--1409[label="1;75pkt 75fpkt"];
940--3276[label="1;135pkt 135fpkt"];
940--3290[label="1;135pkt 135fpkt"];
940--3299[label="1;135pkt 135fpkt"];
940--3826[label="1;135pkt 135fpkt"];
1409--3276[label="1;75pkt 75fpkt"];
1409--3290[label="1;75pkt 75fpkt"];
1409--3299[label="1;75pkt 75fpkt"];
1409--3826[label="1;75pkt 75fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.34.15.113" src_port="1026"/>
    </slice>
    <from sec="1041397223" usec="0"/>
    <to sec="1041397245" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_245{
style=filled;
color=gray75;
321[label="88.34.105.113s;239pkt 239fpkt", shape=rectangle, color=red];
941[label="88.34.105.113s;150pkt 150fpkt", shape=ellipse, color=green];
1410[label="88.34.105.113s;150pkt 150fpkt", shape=triangle, color=blue];
3829[label="88.34.105.113;238pkt 238fpkt", shape=pentagon, color=darkviolet];
4675[label="88.34.105.113;238pkt 238fpkt", shape=invtriangle, color=brown];
5131[label="88.34.105.113;238pkt 238fpkt", shape=invhouse, color=bisque];
stat245[shape=component, label=&lt;Rules:&lt;BR/&gt;{88.34.105.113:1036, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1036: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
321--941[label="1;150pkt 150fpkt"];
321--1410[label="1;150pkt 150fpkt"];
321--3829[label="1;238pkt 238fpkt"];
321--4675[label="1;238pkt 238fpkt"];
321--5131[label="1;238pkt 238fpkt"];
941--1410[label="1;150pkt 150fpkt"];
941--3829[label="1;150pkt 150fpkt"];
941--4675[label="1;150pkt 150fpkt"];
941--5131[label="1;150pkt 150fpkt"];
1410--3829[label="1;150pkt 150fpkt"];
1410--4675[label="1;150pkt 150fpkt"];
1410--5131[label="1;150pkt 150fpkt"];
3829--4675[label="1;238pkt 238fpkt"];
3829--5131[label="1;238pkt 238fpkt"];
4675--5131[label="1;238pkt 238fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="88.34.105.113" src_port="1036"/>
    </slice>
    <from sec="1041397814" usec="0"/>
    <to sec="1041397852" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.04191,1.81684,503,1 1 1 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_246{
style=filled;
color=gray75;
322[label="217.89.143.113s;1pkt 1fpkt", shape=rectangle, color=red];
942[label="217.89.143.113s;1pkt 1fpkt", shape=ellipse, color=green];
1411[label="217.89.143.113s;1pkt 1fpkt", shape=triangle, color=blue];
2203[label="88.165.211.113;s;3pkt 3fpkt", shape=diamond, color=yellow];
3834[label="88.165.211.113;4pkt 4fpkt", shape=pentagon, color=darkviolet];
4680[label="88.165.211.113;3pkt 3fpkt", shape=invtriangle, color=brown];
stat246[shape=component, label=&lt;Rules:&lt;BR/&gt;{88.165.211.113:80, 202.159.192.25:1830}[25%]&lt;BR/&gt;{88.165.211.113:80, 202.159.192.25:5078}[25%]&lt;BR/&gt;{88.165.211.113:80, 202.159.192.25:31226}[25%]&lt;BR/&gt;{88.165.211.113:80, 202.159.192.25:32694}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1830: (23.0769%)&lt;BR/&gt; 32694: (11.5385%)&lt;BR/&gt; 31226: (7.69231%)&lt;BR/&gt; 5078: (7.69231%)&gt;];
}
322--942[label="1;1pkt 1fpkt"];
322--1411[label="1;1pkt 1fpkt"];
322--1655[label="1;1pkt 1fpkt"];
322--2203[label="1;1pkt 1fpkt"];
322--3834[label="1;1pkt 1fpkt"];
322--4680[label="1;1pkt 1fpkt"];
942--1411[label="1;1pkt 1fpkt"];
942--1655[label="1;1pkt 1fpkt"];
942--2203[label="1;1pkt 1fpkt"];
942--3834[label="1;1pkt 1fpkt"];
942--4680[label="1;1pkt 1fpkt"];
1411--1655[label="1;1pkt 1fpkt"];
1411--2203[label="1;1pkt 1fpkt"];
1411--3834[label="1;1pkt 1fpkt"];
1411--4680[label="1;1pkt 1fpkt"];
2203--3834[label="1;3pkt 3fpkt"];
2203--4680[label="0.666667;2pkt 2fpkt"];
3834--4680[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="202.159.192.25" dst_port="32694" src_ip="88.165.211.113" src_port="80"/>
      <filter dst_ip="202.159.192.25" dst_port="31226" src_ip="88.165.211.113" src_port="80"/>
      <filter dst_ip="202.159.192.25" dst_port="5078" src_ip="88.165.211.113" src_port="80"/>
      <filter dst_ip="202.159.192.25" dst_port="1830" src_ip="88.165.211.113" src_port="80"/>
    </slice>
    <from sec="1041397456" usec="0"/>
    <to sec="1041398077" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_247{
style=filled;
color=gray75;
323[label="61.161.215.113s;251pkt 251fpkt", shape=rectangle, color=red];
943[label="61.161.215.113s;251pkt 251fpkt", shape=ellipse, color=green];
1412[label="61.161.215.113s;132pkt 132fpkt", shape=triangle, color=blue];
3835[label="61.161.215.113;256pkt 256fpkt", shape=pentagon, color=darkviolet];
4681[label="61.161.215.113;255pkt 255fpkt", shape=invtriangle, color=brown];
5134[label="61.161.215.113;256pkt 256fpkt", shape=invhouse, color=bisque];
stat247[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.161.215.113:61084, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 61084: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
323--943[label="1;251pkt 251fpkt"];
323--1412[label="1;132pkt 132fpkt"];
323--3835[label="1;251pkt 251fpkt"];
323--4681[label="0.996016;250pkt 250fpkt"];
323--5134[label="1;251pkt 251fpkt"];
943--1412[label="1;132pkt 132fpkt"];
943--3835[label="1;251pkt 251fpkt"];
943--4681[label="0.996016;250pkt 250fpkt"];
943--5134[label="1;251pkt 251fpkt"];
1412--3835[label="1;132pkt 132fpkt"];
1412--4681[label="0.992424;131pkt 131fpkt"];
1412--5134[label="1;132pkt 132fpkt"];
3835--4681[label="1;255pkt 255fpkt"];
3835--5134[label="1;256pkt 256fpkt"];
4681--5134[label="1;255pkt 255fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.161.215.113" src_port="61084"/>
    </slice>
    <from sec="1041398583" usec="0"/>
    <to sec="1041398627" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_248{
style=filled;
color=gray75;
325[label="211.142.175.114s;61pkt 61fpkt", shape=rectangle, color=red];
945[label="211.142.175.114s;61pkt 61fpkt", shape=ellipse, color=green];
stat248[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.142.175.114:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
325--945[label="1;61pkt 61fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="211.142.175.114" src_port="1029"/>
    </slice>
    <from sec="1041397980" usec="0"/>
    <to sec="1041397993" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.04886,1.90254,503,1 1 1 0 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_249{
style=filled;
color=gray75;
327[label="217.32.60.115s;1pkt 1fpkt", shape=rectangle, color=red];
947[label="217.32.60.115s;1pkt 1fpkt", shape=ellipse, color=green];
1415[label="217.32.60.115s;1pkt 1fpkt", shape=triangle, color=blue];
2931[label="172.142.192.115;s;39pkt 39fpkt", shape=hexagon, color=black];
stat249[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.142.192.115:80, 192.85.231.60:*}[79.4872%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (42.8571%)&lt;BR/&gt; 59296: (4.7619%)&lt;BR/&gt; 5190: (4.7619%)&lt;BR/&gt; 25: (2.38095%)&lt;BR/&gt; 64423: (1.19048%)&gt;];
}
327--947[label="1;1pkt 1fpkt"];
327--1415[label="1;1pkt 1fpkt"];
327--2931[label="1;1pkt 1fpkt"];
947--1415[label="1;1pkt 1fpkt"];
947--2931[label="1;1pkt 1fpkt"];
1415--2931[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="192.85.231.60" src_ip="172.142.192.115" src_port="80"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398026" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_250{
style=filled;
color=gray75;
328[label="61.234.207.115s;125pkt 125fpkt", shape=rectangle, color=red];
948[label="61.234.207.115s;125pkt 125fpkt", shape=ellipse, color=green];
1416[label="61.234.207.115s;125pkt 125fpkt", shape=triangle, color=blue];
3846[label="61.234.207.115;144pkt 144fpkt", shape=pentagon, color=darkviolet];
stat250[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.234.207.115:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
328--948[label="1;125pkt 125fpkt"];
328--1416[label="1;125pkt 125fpkt"];
328--3846[label="1;125pkt 125fpkt"];
948--1416[label="1;125pkt 125fpkt"];
948--3846[label="1;125pkt 125fpkt"];
1416--3846[label="1;125pkt 125fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.234.207.115" src_port="1029"/>
    </slice>
    <from sec="1041398373" usec="0"/>
    <to sec="1041398396" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_251{
style=filled;
color=gray75;
329[label="217.87.23.116s;158pkt 158fpkt", shape=rectangle, color=red];
949[label="217.87.23.116s;158pkt 158fpkt", shape=ellipse, color=green];
1417[label="217.87.23.116s;158pkt 158fpkt", shape=triangle, color=blue];
3847[label="217.87.23.116;158pkt 158fpkt", shape=pentagon, color=darkviolet];
4690[label="217.87.23.116;157pkt 157fpkt", shape=invtriangle, color=brown];
stat251[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.87.23.116:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
329--949[label="1;158pkt 158fpkt"];
329--1417[label="1;158pkt 158fpkt"];
329--3847[label="1;158pkt 158fpkt"];
329--4690[label="1;157pkt 157fpkt"];
949--1417[label="1;158pkt 158fpkt"];
949--3847[label="1;158pkt 158fpkt"];
949--4690[label="1;157pkt 157fpkt"];
1417--3847[label="1;158pkt 158fpkt"];
1417--4690[label="1;157pkt 157fpkt"];
3847--4690[label="1;157pkt 157fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.87.23.116" src_port="1026"/>
    </slice>
    <from sec="1041397358" usec="0"/>
    <to sec="1041397388" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_252{
style=filled;
color=gray75;
330[label="70.128.75.116s;85pkt 85fpkt", shape=rectangle, color=red];
950[label="70.128.75.116s;85pkt 85fpkt", shape=ellipse, color=green];
1418[label="70.128.75.116s;85pkt 85fpkt", shape=triangle, color=blue];
stat252[shape=component, label=&lt;Rules:&lt;BR/&gt;{70.128.75.116:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
330--950[label="1;85pkt 85fpkt"];
330--1418[label="1;85pkt 85fpkt"];
950--1418[label="1;85pkt 85fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="70.128.75.116" src_port="1025"/>
    </slice>
    <from sec="1041397547" usec="0"/>
    <to sec="1041397561" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.620401,1.94046,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="202.159.194.95" dst_port="137" proto="tcp" src_ip="133.209.83.119" src_port="1033"/>
      <filter dst_ip="202.159.194.95" dst_port="137" proto="udp" src_ip="133.209.83.119" src_port="1033"/>
      <filter dst_ip="202.159.194.95" dst_port="137" proto="tcp" src_ip="133.209.83.119" src_port="80"/>
      <filter dst_ip="202.159.194.95" dst_port="137" proto="udp" src_ip="133.209.83.119" src_port="80"/>
      <from sec="1041397589" usec="0"/>
      <to sec="1041397624" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="202.159.194.95" dst_port="137" proto="tcp" src_ip="213.26.139.119" src_port="1033"/>
      <filter dst_ip="202.159.194.95" dst_port="137" proto="udp" src_ip="213.26.139.119" src_port="1033"/>
      <filter dst_ip="202.159.194.95" dst_port="137" proto="tcp" src_ip="213.26.139.119" src_port="80"/>
      <filter dst_ip="202.159.194.95" dst_port="137" proto="udp" src_ip="213.26.139.119" src_port="80"/>
      <from sec="1041397590" usec="0"/>
      <to sec="1041397620" usec="0"/>
    </slice>
    <from sec="1041397589" usec="0"/>
    <to sec="1041397624" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_255{
style=filled;
color=gray75;
336[label="61.139.45.120s;68pkt 68fpkt", shape=rectangle, color=red];
955[label="61.139.45.120s;68pkt 68fpkt", shape=ellipse, color=green];
stat255[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.139.45.120:1036, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1036: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
336--955[label="1;68pkt 68fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.139.45.120" src_port="1036"/>
    </slice>
    <from sec="1041397636" usec="0"/>
    <to sec="1041397654" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_256{
style=filled;
color=gray75;
340[label="211.167.0.123s;256pkt 256fpkt", shape=rectangle, color=red];
959[label="211.167.0.123s;256pkt 256fpkt", shape=ellipse, color=green];
stat256[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.167.0.123:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
340--959[label="1;256pkt 256fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="211.167.0.123" src_port="1025"/>
    </slice>
    <from sec="1041397984" usec="0"/>
    <to sec="1041398026" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_257{
style=filled;
color=gray75;
341[label="154.165.37.123s;100pkt 100fpkt", shape=rectangle, color=red];
342[label="62.23.53.123s;107pkt 107fpkt", shape=rectangle, color=red];
960[label="154.165.37.123s;135pkt 135fpkt", shape=ellipse, color=green];
1425[label="154.165.37.123s;135pkt 135fpkt", shape=triangle, color=blue];
stat257[shape=component, label=&lt;Rules:&lt;BR/&gt;{62.23.53.123:1026, *:137}[51.6908%]&lt;BR/&gt;{154.165.37.123:1030, *:137}[48.3092%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 1030: (25.1572%)&lt;BR/&gt; 1026: (24.8428%)&gt;];
}
341--960[label="0.7;70pkt 70fpkt"];
341--1425[label="0.7;70pkt 70fpkt"];
342--960[label="0.607477;65pkt 65fpkt"];
342--1425[label="0.607477;65pkt 65fpkt"];
960--1425[label="1;135pkt 135fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="62.23.53.123" src_port="1026"/>
      <filter dst_port="137" src_ip="154.165.37.123" src_port="1030"/>
    </slice>
    <from sec="1041398339" usec="0"/>
    <to sec="1041398370" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_258{
style=filled;
color=gray75;
344[label="202.216.19.125s;139pkt 139fpkt", shape=rectangle, color=red];
962[label="202.216.19.125s;93pkt 93fpkt", shape=ellipse, color=green];
1427[label="202.216.19.125s;93pkt 93fpkt", shape=triangle, color=blue];
3882[label="202.216.19.125;139pkt 139fpkt", shape=pentagon, color=darkviolet];
4709[label="202.216.19.125;138pkt 138fpkt", shape=invtriangle, color=brown];
stat258[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.216.19.125:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
344--962[label="1;93pkt 93fpkt"];
344--1427[label="1;93pkt 93fpkt"];
344--3882[label="1;139pkt 139fpkt"];
344--4709[label="1;138pkt 138fpkt"];
962--1427[label="1;93pkt 93fpkt"];
962--3882[label="1;93pkt 93fpkt"];
962--4709[label="0.989247;92pkt 92fpkt"];
1427--3882[label="1;93pkt 93fpkt"];
1427--4709[label="0.989247;92pkt 92fpkt"];
3882--4709[label="1;138pkt 138fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="202.216.19.125" src_port="1027"/>
    </slice>
    <from sec="1041398050" usec="0"/>
    <to sec="1041398073" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_259{
style=filled;
color=gray75;
348[label="217.88.169.126s;227pkt 227fpkt", shape=rectangle, color=red];
966[label="217.88.169.126s;91pkt 91fpkt", shape=ellipse, color=green];
1430[label="217.88.169.126s;91pkt 91fpkt", shape=triangle, color=blue];
3890[label="217.88.169.126;242pkt 242fpkt", shape=pentagon, color=darkviolet];
stat259[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.88.169.126:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
348--966[label="1;91pkt 91fpkt"];
348--1430[label="1;91pkt 91fpkt"];
348--3890[label="1;227pkt 227fpkt"];
966--1430[label="1;91pkt 91fpkt"];
966--3890[label="1;91pkt 91fpkt"];
1430--3890[label="1;91pkt 91fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.88.169.126" src_port="1027"/>
    </slice>
    <from sec="1041397986" usec="0"/>
    <to sec="1041398031" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_260{
style=filled;
color=gray75;
354[label="90.182.164.128s;255pkt 255fpkt", shape=rectangle, color=red];
971[label="90.182.164.128s;255pkt 255fpkt", shape=ellipse, color=green];
1435[label="90.182.164.128s;255pkt 255fpkt", shape=triangle, color=blue];
stat260[shape=component, label=&lt;Rules:&lt;BR/&gt;{90.182.164.128:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
354--971[label="1;255pkt 255fpkt"];
354--1435[label="1;255pkt 255fpkt"];
971--1435[label="1;255pkt 255fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="90.182.164.128" src_port="1026"/>
    </slice>
    <from sec="1041398210" usec="0"/>
    <to sec="1041398230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.02037,1.88019,002,1 1 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_261{
style=filled;
color=gray75;
355[label="61.200.16.129s;244pkt 244fpkt", shape=rectangle, color=red];
972[label="61.200.16.129s;244pkt 244fpkt", shape=ellipse, color=green];
3905[label="61.200.16.129;243pkt 243fpkt", shape=pentagon, color=darkviolet];
4723[label="61.200.16.129;243pkt 243fpkt", shape=invtriangle, color=brown];
5157[label="61.200.16.129;243pkt 243fpkt", shape=invhouse, color=bisque];
stat261[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.200.16.129:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
355--972[label="1;244pkt 244fpkt"];
355--3905[label="1;243pkt 243fpkt"];
355--4723[label="1;243pkt 243fpkt"];
355--5157[label="1;243pkt 243fpkt"];
972--3905[label="1;243pkt 243fpkt"];
972--4723[label="1;243pkt 243fpkt"];
972--5157[label="1;243pkt 243fpkt"];
3905--4723[label="1;243pkt 243fpkt"];
3905--5157[label="1;243pkt 243fpkt"];
4723--5157[label="1;243pkt 243fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.200.16.129" src_port="1027"/>
    </slice>
    <from sec="1041397467" usec="0"/>
    <to sec="1041397511" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_262{
style=filled;
color=gray75;
356[label="61.136.23.129s;111pkt 111fpkt", shape=rectangle, color=red];
973[label="61.136.23.129s;90pkt 90fpkt", shape=ellipse, color=green];
stat262[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.136.23.129:64825, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 64825: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
356--973[label="1;90pkt 90fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.136.23.129" src_port="64825"/>
    </slice>
    <from sec="1041397338" usec="0"/>
    <to sec="1041397357" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_263{
style=filled;
color=gray75;
360[label="217.74.204.130s;223pkt 223fpkt", shape=rectangle, color=red];
974[label="217.74.204.130s;96pkt 96fpkt", shape=ellipse, color=green];
1464[label="216.241.148.149s;357pkt 357fpkt", shape=triangle, color=blue];
3917[label="217.74.204.130;221pkt 221fpkt", shape=pentagon, color=darkviolet];
4729[label="217.74.204.130;221pkt 221fpkt", shape=invtriangle, color=brown];
stat263[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.74.204.130:1028, *:137}[45.5102%]&lt;BR/&gt;{216.241.148.149:1027, *:137}[30.8163%]&lt;BR/&gt;{200.90.91.134:1036, *:137}[23.6735%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 1028: (38.059%)&lt;BR/&gt; 1027: (6.75313%)&lt;BR/&gt; 1036: (5.18784%)&gt;];
}
360--974[label="1;96pkt 96fpkt"];
360--1464[label="0.403587;90pkt 90fpkt"];
360--3917[label="1;221pkt 221fpkt"];
360--4729[label="1;221pkt 221fpkt"];
974--1464[label="0.9375;90pkt 90fpkt"];
974--3917[label="0.989583;95pkt 95fpkt"];
974--4729[label="0.989583;95pkt 95fpkt"];
1464--3917[label="0.402715;89pkt 89fpkt"];
1464--3940[label="1;115pkt 115fpkt"];
1464--4729[label="0.402715;89pkt 89fpkt"];
1464--4744[label="1;115pkt 115fpkt"];
1464--5166[label="1;115pkt 115fpkt"];
3917--4729[label="1;221pkt 221fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.74.204.130" src_port="1028"/>
      <filter dst_port="137" src_ip="216.241.148.149" src_port="1027"/>
      <filter dst_port="137" src_ip="200.90.91.134" src_port="1036"/>
    </slice>
    <from sec="1041397291" usec="0"/>
    <to sec="1041397337" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.18661,1.85795,999,1 1 1 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_264{
style=filled;
color=gray75;
48[label="88.106.10.131s;1pkt 1fpkt", shape=rectangle, color=red];
734[label="61.88.82.131s;1pkt 1fpkt", shape=ellipse, color=green];
975[label="203.99.38.131s;1pkt 1fpkt", shape=ellipse, color=green];
977[label="61.160.110.131s;1pkt 1fpkt", shape=ellipse, color=green];
1436[label="61.88.82.131s;1pkt 1fpkt", shape=triangle, color=blue];
1697[label="148.132.180.56;d;199pkt 199fpkt", shape=diamond, color=yellow];
1899[label="88.106.10.131;s;1pkt 1fpkt", shape=diamond, color=yellow];
2302[label="145.200.12.102;s;2pkt 2fpkt", shape=diamond, color=yellow];
2498[label="211.55.125.75;s;2pkt 2fpkt", shape=diamond, color=yellow];
3012[label="148.132.180.56;d;183pkt 183fpkt", shape=hexagon, color=black];
3101[label="211.55.125.75;s;2pkt 2fpkt", shape=hexagon, color=black];
3672[label="211.55.125.75;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3782[label="145.200.12.102;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat264[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:6257, 148.132.180.56:6257}[94.9749%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6257: (92.9293%)&lt;BR/&gt; 6699: (3.15657%)&lt;BR/&gt; 4361: (1.0101%)&lt;BR/&gt; 2787: (0.631313%)&lt;BR/&gt; 16257: (0.505051%)&gt;];
}
48--734[label="1;1pkt 1fpkt"];
48--975[label="1;1pkt 1fpkt"];
48--977[label="1;1pkt 1fpkt"];
48--1436[label="1;1pkt 1fpkt"];
48--1697[label="1;1pkt 1fpkt"];
48--1899[label="1;1pkt 1fpkt"];
48--3012[label="1;1pkt 1fpkt"];
734--975[label="1;1pkt 1fpkt"];
734--977[label="1;1pkt 1fpkt"];
734--1436[label="1;1pkt 1fpkt"];
734--1697[label="1;1pkt 1fpkt"];
734--1899[label="1;1pkt 1fpkt"];
734--3012[label="1;1pkt 1fpkt"];
975--977[label="1;1pkt 1fpkt"];
975--1436[label="1;1pkt 1fpkt"];
975--1697[label="1;1pkt 1fpkt"];
975--1899[label="1;1pkt 1fpkt"];
975--3012[label="1;1pkt 1fpkt"];
977--1436[label="1;1pkt 1fpkt"];
977--1697[label="1;1pkt 1fpkt"];
977--1899[label="1;1pkt 1fpkt"];
977--3012[label="1;1pkt 1fpkt"];
1436--1697[label="1;1pkt 1fpkt"];
1436--1899[label="1;1pkt 1fpkt"];
1436--3012[label="1;1pkt 1fpkt"];
1697--1812[label="1;1pkt 1fpkt"];
1697--1899[label="1;1pkt 1fpkt"];
1697--2302[label="1;2pkt 2fpkt"];
1697--2498[label="1;2pkt 2fpkt"];
1697--3012[label="1;183pkt 183fpkt"];
1697--3101[label="1;2pkt 2fpkt"];
1697--3277[label="0.0904523;18pkt 18fpkt"];
1697--3281[label="0.19598;39pkt 39fpkt"];
1697--3286[label="0.0653266;13pkt 13fpkt"];
1697--3291[label="0.0904523;18pkt 18fpkt"];
1697--3300[label="0.0904523;18pkt 18fpkt"];
1697--3672[label="1;1pkt 1fpkt"];
1697--3782[label="1;1pkt 1fpkt"];
1899--3012[label="1;1pkt 1fpkt"];
2302--3012[label="1;2pkt 2fpkt"];
2302--3782[label="1;1pkt 1fpkt"];
2498--3012[label="1;2pkt 2fpkt"];
2498--3101[label="1;2pkt 2fpkt"];
2498--3281[label="0.5;1pkt 1fpkt"];
2498--3672[label="1;1pkt 1fpkt"];
3012--3101[label="1;2pkt 2fpkt"];
3012--3277[label="0.0983607;18pkt 18fpkt"];
3012--3281[label="0.20765;38pkt 38fpkt"];
3012--3286[label="0.0546448;10pkt 10fpkt"];
3012--3291[label="0.0983607;18pkt 18fpkt"];
3012--3300[label="0.0983607;18pkt 18fpkt"];
3012--3672[label="1;1pkt 1fpkt"];
3012--3782[label="1;1pkt 1fpkt"];
3101--3281[label="0.5;1pkt 1fpkt"];
3101--3672[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="148.132.180.56" dst_port="6257" src_port="6257"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_265{
style=filled;
color=gray75;
367[label="217.34.20.132s;89pkt 89fpkt", shape=rectangle, color=red];
979[label="217.34.20.132s;89pkt 89fpkt", shape=ellipse, color=green];
stat265[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.34.20.132:1030, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1030: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
367--979[label="1;89pkt 89fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.34.20.132" src_port="1030"/>
    </slice>
    <from sec="1041397855" usec="0"/>
    <to sec="1041397870" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_266{
style=filled;
color=gray75;
369[label="91.91.52.133s;108pkt 108fpkt", shape=rectangle, color=red];
980[label="91.91.52.133s;108pkt 108fpkt", shape=ellipse, color=green];
1438[label="91.91.52.133s;108pkt 108fpkt", shape=triangle, color=blue];
3929[label="91.91.52.133;122pkt 122fpkt", shape=pentagon, color=darkviolet];
4738[label="91.91.52.133;122pkt 122fpkt", shape=invtriangle, color=brown];
stat266[shape=component, label=&lt;Rules:&lt;BR/&gt;{91.91.52.133:1030, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1030: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
369--980[label="1;108pkt 108fpkt"];
369--1438[label="1;108pkt 108fpkt"];
369--3929[label="1;108pkt 108fpkt"];
369--4738[label="1;108pkt 108fpkt"];
980--1438[label="1;108pkt 108fpkt"];
980--3929[label="1;108pkt 108fpkt"];
980--4738[label="1;108pkt 108fpkt"];
1438--3929[label="1;108pkt 108fpkt"];
1438--4738[label="1;108pkt 108fpkt"];
3929--4738[label="1;122pkt 122fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="91.91.52.133" src_port="1030"/>
    </slice>
    <from sec="1041398159" usec="0"/>
    <to sec="1041398178" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_267{
style=filled;
color=gray75;
370[label="4.202.86.133s;123pkt 123fpkt", shape=rectangle, color=red];
981[label="4.202.86.133s;123pkt 123fpkt", shape=ellipse, color=green];
1439[label="4.202.86.133s;123pkt 123fpkt", shape=triangle, color=blue];
3931[label="4.202.86.133;143pkt 143fpkt", shape=pentagon, color=darkviolet];
4740[label="4.202.86.133;143pkt 143fpkt", shape=invtriangle, color=brown];
5163[label="4.202.86.133;143pkt 143fpkt", shape=invhouse, color=bisque];
stat267[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.202.86.133:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
370--981[label="1;123pkt 123fpkt"];
370--1439[label="1;123pkt 123fpkt"];
370--3285[label="1;123pkt 123fpkt"];
370--3931[label="1;123pkt 123fpkt"];
370--4740[label="1;123pkt 123fpkt"];
370--5163[label="1;123pkt 123fpkt"];
981--1439[label="1;123pkt 123fpkt"];
981--3285[label="1;123pkt 123fpkt"];
981--3931[label="1;123pkt 123fpkt"];
981--4740[label="1;123pkt 123fpkt"];
981--5163[label="1;123pkt 123fpkt"];
1439--3285[label="1;123pkt 123fpkt"];
1439--3931[label="1;123pkt 123fpkt"];
1439--4740[label="1;123pkt 123fpkt"];
1439--5163[label="1;123pkt 123fpkt"];
3931--4740[label="1;143pkt 143fpkt"];
3931--5163[label="1;143pkt 143fpkt"];
4740--5163[label="1;143pkt 143fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="4.202.86.133" src_port="1027"/>
    </slice>
    <from sec="1041398744" usec="0"/>
    <to sec="1041398766" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.620401,1.94046,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="192.211.37.53" dst_port="137" proto="tcp" src_ip="211.65.99.133" src_port="62414"/>
      <filter dst_ip="192.211.37.53" dst_port="137" proto="udp" src_ip="211.65.99.133" src_port="62414"/>
      <filter dst_ip="192.211.37.53" dst_port="80" proto="tcp" src_ip="211.65.99.133" src_port="62414"/>
      <filter dst_ip="192.211.37.53" dst_port="80" proto="udp" src_ip="211.65.99.133" src_port="62414"/>
      <from sec="1041397768" usec="0"/>
      <to sec="1041397784" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="192.211.37.53" dst_port="137" proto="tcp" src_ip="136.234.91.133" src_port="62414"/>
      <filter dst_ip="192.211.37.53" dst_port="137" proto="udp" src_ip="136.234.91.133" src_port="62414"/>
      <filter dst_ip="192.211.37.53" dst_port="80" proto="tcp" src_ip="136.234.91.133" src_port="62414"/>
      <filter dst_ip="192.211.37.53" dst_port="80" proto="udp" src_ip="136.234.91.133" src_port="62414"/>
      <from sec="1041397768" usec="0"/>
      <to sec="1041397781" usec="0"/>
    </slice>
    <from sec="1041397768" usec="0"/>
    <to sec="1041397784" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_269{
style=filled;
color=gray75;
373[label="63.38.211.133s;197pkt 197fpkt", shape=rectangle, color=red];
983[label="63.38.211.133s;197pkt 197fpkt", shape=ellipse, color=green];
1441[label="63.38.211.133s;197pkt 197fpkt", shape=triangle, color=blue];
3936[label="63.38.211.133;197pkt 197fpkt", shape=pentagon, color=darkviolet];
stat269[shape=component, label=&lt;Rules:&lt;BR/&gt;{63.38.211.133:1046, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1046: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
373--983[label="1;197pkt 197fpkt"];
373--1441[label="1;197pkt 197fpkt"];
373--3936[label="1;197pkt 197fpkt"];
983--1441[label="1;197pkt 197fpkt"];
983--3936[label="1;197pkt 197fpkt"];
1441--3936[label="1;197pkt 197fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="63.38.211.133" src_port="1046"/>
    </slice>
    <from sec="1041398244" usec="0"/>
    <to sec="1041398281" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_270{
style=filled;
color=gray75;
374[label="4.174.28.134s;98pkt 98fpkt", shape=rectangle, color=red];
984[label="4.174.28.134s;98pkt 98fpkt", shape=ellipse, color=green];
1442[label="4.174.28.134s;98pkt 98fpkt", shape=triangle, color=blue];
3939[label="4.174.28.134;136pkt 136fpkt", shape=pentagon, color=darkviolet];
4743[label="4.174.28.134;135pkt 135fpkt", shape=invtriangle, color=brown];
5165[label="4.174.28.134;135pkt 135fpkt", shape=invhouse, color=bisque];
stat270[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.174.28.134:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
374--984[label="1;98pkt 98fpkt"];
374--1442[label="1;98pkt 98fpkt"];
374--3939[label="1;98pkt 98fpkt"];
374--4743[label="1;98pkt 98fpkt"];
374--5165[label="1;98pkt 98fpkt"];
984--1442[label="1;98pkt 98fpkt"];
984--3939[label="1;98pkt 98fpkt"];
984--4743[label="1;98pkt 98fpkt"];
984--5165[label="1;98pkt 98fpkt"];
1442--3939[label="1;98pkt 98fpkt"];
1442--4743[label="1;98pkt 98fpkt"];
1442--5165[label="1;98pkt 98fpkt"];
3939--4743[label="1;135pkt 135fpkt"];
3939--5165[label="1;135pkt 135fpkt"];
4743--5165[label="1;135pkt 135fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="4.174.28.134" src_port="1026"/>
    </slice>
    <from sec="1041398706" usec="0"/>
    <to sec="1041398727" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_271{
style=filled;
color=gray75;
380[label="89.2.121.135s;160pkt 160fpkt", shape=rectangle, color=red];
428[label="4.69.131.156s;133pkt 133fpkt", shape=rectangle, color=red];
987[label="89.2.121.135s;116pkt 116fpkt", shape=ellipse, color=green];
1445[label="89.2.121.135s;116pkt 116fpkt", shape=triangle, color=blue];
4040[label="4.69.131.156;133pkt 133fpkt", shape=pentagon, color=darkviolet];
stat271[shape=component, label=&lt;Rules:&lt;BR/&gt;{89.2.121.135:1051, *:137}[54.6075%]&lt;BR/&gt;{4.69.131.156:1043, *:137}[45.3925%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 1051: (29.7872%)&lt;BR/&gt; 1043: (20.2128%)&gt;];
}
380--987[label="1;116pkt 116fpkt"];
380--1445[label="1;116pkt 116fpkt"];
380--3285[label="0.43125;69pkt 69fpkt"];
428--1026[label="1;88pkt 88fpkt"];
428--3285[label="0.56391;75pkt 75fpkt"];
428--4040[label="1;133pkt 133fpkt"];
987--1445[label="1;116pkt 116fpkt"];
987--3285[label="0.594828;69pkt 69fpkt"];
1445--3285[label="0.594828;69pkt 69fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="89.2.121.135" src_port="1051"/>
      <filter dst_port="137" src_ip="4.69.131.156" src_port="1043"/>
    </slice>
    <from sec="1041398720" usec="0"/>
    <to sec="1041398795" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_272{
style=filled;
color=gray75;
383[label="209.212.209.137s;104pkt 104fpkt", shape=rectangle, color=red];
990[label="209.212.209.137s;104pkt 104fpkt", shape=ellipse, color=green];
stat272[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.212.209.137:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
383--990[label="1;104pkt 104fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="209.212.209.137" src_port="1027"/>
    </slice>
    <from sec="1041398681" usec="0"/>
    <to sec="1041398697" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_273{
style=filled;
color=gray75;
385[label="62.134.190.138s;140pkt 140fpkt", shape=rectangle, color=red];
992[label="62.134.190.138s;134pkt 134fpkt", shape=ellipse, color=green];
1449[label="62.134.190.138s;134pkt 134fpkt", shape=triangle, color=blue];
stat273[shape=component, label=&lt;Rules:&lt;BR/&gt;{62.134.190.138:62367, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 62367: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
385--992[label="1;134pkt 134fpkt"];
385--1449[label="1;134pkt 134fpkt"];
992--1449[label="1;134pkt 134fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="62.134.190.138" src_port="62367"/>
    </slice>
    <from sec="1041397248" usec="0"/>
    <to sec="1041397270" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.770694,1.8419,002,1 1 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_274{
style=filled;
color=gray75;
391[label="217.128.65.142s;97pkt 97fpkt", shape=rectangle, color=red];
998[label="217.128.65.142s;97pkt 97fpkt", shape=ellipse, color=green];
3981[label="202.40.109.142;44pkt 44fpkt", shape=pentagon, color=darkviolet];
4764[label="202.40.109.142;44pkt 44fpkt", shape=invtriangle, color=brown];
stat274[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.128.65.142:1026, *:137}[67.1642%]&lt;BR/&gt;{202.40.109.142:32774, *:53}[29.8507%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (31.9149%)&lt;BR/&gt; 137: (31.9149%)&lt;BR/&gt; 53: (17.7305%)&lt;BR/&gt; 32774: (17.0213%)&lt;BR/&gt; 59878: (0.35461%)&gt;];
}
391--998[label="1;97pkt 97fpkt"];
391--2690[label="0.05;1pkt 1fpkt"];
391--3274[label="0.0103093;1pkt 1fpkt"];
391--3288[label="0.0103093;1pkt 1fpkt"];
391--3297[label="0.0103093;1pkt 1fpkt"];
391--3981[label="0.159091;7pkt 7fpkt"];
391--4764[label="0.159091;7pkt 7fpkt"];
998--2690[label="0.05;1pkt 1fpkt"];
998--3274[label="0.0103093;1pkt 1fpkt"];
998--3288[label="0.0103093;1pkt 1fpkt"];
998--3297[label="0.0103093;1pkt 1fpkt"];
998--3981[label="0.159091;7pkt 7fpkt"];
998--4764[label="0.159091;7pkt 7fpkt"];
3981--4764[label="1;44pkt 44fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.128.65.142" src_port="1026"/>
      <filter dst_port="53" src_ip="202.40.109.142" src_port="32774"/>
    </slice>
    <from sec="1041397234" usec="0"/>
    <to sec="1041398702" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_275{
style=filled;
color=gray75;
393[label="200.77.86.143s;152pkt 152fpkt", shape=rectangle, color=red];
1000[label="200.77.86.143s;152pkt 152fpkt", shape=ellipse, color=green];
1455[label="200.77.86.143s;152pkt 152fpkt", shape=triangle, color=blue];
3985[label="200.77.86.143;151pkt 151fpkt", shape=pentagon, color=darkviolet];
stat275[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.77.86.143:1046, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1046: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
393--1000[label="1;152pkt 152fpkt"];
393--1455[label="1;152pkt 152fpkt"];
393--3985[label="1;151pkt 151fpkt"];
1000--1455[label="1;152pkt 152fpkt"];
1000--3985[label="1;151pkt 151fpkt"];
1455--3985[label="1;151pkt 151fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="200.77.86.143" src_port="1046"/>
    </slice>
    <from sec="1041397264" usec="0"/>
    <to sec="1041397293" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_276{
style=filled;
color=gray75;
394[label="61.164.132.143s;203pkt 203fpkt", shape=rectangle, color=red];
1001[label="61.164.132.143s;110pkt 110fpkt", shape=ellipse, color=green];
1456[label="61.164.132.143s;110pkt 110fpkt", shape=triangle, color=blue];
3986[label="61.164.132.143;233pkt 233fpkt", shape=pentagon, color=darkviolet];
stat276[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.164.132.143:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
394--1001[label="1;110pkt 110fpkt"];
394--1456[label="1;110pkt 110fpkt"];
394--3986[label="0.995074;202pkt 202fpkt"];
1001--1456[label="1;110pkt 110fpkt"];
1001--3986[label="0.990909;109pkt 109fpkt"];
1456--3986[label="0.990909;109pkt 109fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.164.132.143" src_port="1029"/>
    </slice>
    <from sec="1041398662" usec="0"/>
    <to sec="1041398701" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_277{
style=filled;
color=gray75;
397[label="137.75.151.144s;73pkt 73fpkt", shape=rectangle, color=red];
1003[label="137.75.151.144s;73pkt 73fpkt", shape=ellipse, color=green];
stat277[shape=component, label=&lt;Rules:&lt;BR/&gt;{137.75.151.144:1047, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1047: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
397--1003[label="1;73pkt 73fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="137.75.151.144" src_port="1047"/>
    </slice>
    <from sec="1041398076" usec="0"/>
    <to sec="1041398090" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_278{
style=filled;
color=gray75;
402[label="61.98.138.146s;93pkt 93fpkt", shape=rectangle, color=red];
1006[label="61.98.138.146s;93pkt 93fpkt", shape=ellipse, color=green];
stat278[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.98.138.146:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
402--1006[label="1;93pkt 93fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.98.138.146" src_port="1027"/>
    </slice>
    <from sec="1041398059" usec="0"/>
    <to sec="1041398073" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_279{
style=filled;
color=gray75;
408[label="71.226.87.148s;67pkt 67fpkt", shape=rectangle, color=red];
1010[label="71.226.87.148s;67pkt 67fpkt", shape=ellipse, color=green];
stat279[shape=component, label=&lt;Rules:&lt;BR/&gt;{71.226.87.148:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
408--1010[label="1;67pkt 67fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="71.226.87.148" src_port="1028"/>
    </slice>
    <from sec="1041397247" usec="0"/>
    <to sec="1041397265" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.770694,1.8419,002,1 1 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_280{
style=filled;
color=gray75;
410[label="61.163.163.148s;163pkt 163fpkt", shape=rectangle, color=red];
1011[label="61.163.163.148s;88pkt 88fpkt", shape=ellipse, color=green];
4006[label="61.163.163.148;215pkt 215fpkt", shape=pentagon, color=darkviolet];
4777[label="61.163.163.148;215pkt 215fpkt", shape=invtriangle, color=brown];
stat280[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.163.163.148:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
410--1011[label="1;88pkt 88fpkt"];
410--4006[label="1;163pkt 163fpkt"];
410--4777[label="1;163pkt 163fpkt"];
1011--4006[label="1;88pkt 88fpkt"];
1011--4777[label="1;88pkt 88fpkt"];
4006--4777[label="1;215pkt 215fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.163.163.148" src_port="1027"/>
    </slice>
    <from sec="1041397810" usec="0"/>
    <to sec="1041397851" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_281{
style=filled;
color=gray75;
411[label="217.57.184.148s;220pkt 220fpkt", shape=rectangle, color=red];
1012[label="217.57.184.148s;220pkt 220fpkt", shape=ellipse, color=green];
1462[label="217.57.184.148s;220pkt 220fpkt", shape=triangle, color=blue];
stat281[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.57.184.148:1053, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1053: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
411--1012[label="1;220pkt 220fpkt"];
411--1462[label="1;220pkt 220fpkt"];
1012--1462[label="1;220pkt 220fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.57.184.148" src_port="1053"/>
    </slice>
    <from sec="1041397975" usec="0"/>
    <to sec="1041398010" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_282{
style=filled;
color=gray75;
412[label="89.72.194.148s;83pkt 83fpkt", shape=rectangle, color=red];
1013[label="89.72.194.148s;83pkt 83fpkt", shape=ellipse, color=green];
1463[label="89.72.194.148s;83pkt 83fpkt", shape=triangle, color=blue];
stat282[shape=component, label=&lt;Rules:&lt;BR/&gt;{89.72.194.148:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
412--1013[label="1;83pkt 83fpkt"];
412--1463[label="1;83pkt 83fpkt"];
1013--1463[label="1;83pkt 83fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="89.72.194.148" src_port="1025"/>
    </slice>
    <from sec="1041398315" usec="0"/>
    <to sec="1041398330" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_283{
style=filled;
color=gray75;
416[label="4.147.154.150s;185pkt 185fpkt", shape=rectangle, color=red];
1016[label="4.147.154.150s;185pkt 185fpkt", shape=ellipse, color=green];
1465[label="4.147.154.150s;174pkt 174fpkt", shape=triangle, color=blue];
4014[label="4.147.154.150;186pkt 186fpkt", shape=pentagon, color=darkviolet];
stat283[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.147.154.150:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
416--1016[label="1;185pkt 185fpkt"];
416--1465[label="1;174pkt 174fpkt"];
416--4014[label="1;185pkt 185fpkt"];
1016--1465[label="1;174pkt 174fpkt"];
1016--4014[label="1;185pkt 185fpkt"];
1465--4014[label="1;174pkt 174fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="4.147.154.150" src_port="1025"/>
    </slice>
    <from sec="1041397755" usec="0"/>
    <to sec="1041397786" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.649115,1.85851,002,1 1 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_284{
style=filled;
color=gray75;
417[label="217.134.235.151s;184pkt 184fpkt", shape=rectangle, color=red];
1017[label="217.134.235.151s;63pkt 63fpkt", shape=ellipse, color=green];
4021[label="217.134.235.151;184pkt 184fpkt", shape=pentagon, color=darkviolet];
stat284[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.134.235.151:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
417--1017[label="1;63pkt 63fpkt"];
417--1648[label="0.00543478;1pkt 1fpkt"];
417--4021[label="1;184pkt 184fpkt"];
1017--4021[label="1;63pkt 63fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.134.235.151" src_port="1028"/>
    </slice>
    <from sec="1041398303" usec="0"/>
    <to sec="1041398345" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_285{
style=filled;
color=gray75;
418[label="200.79.10.152s;95pkt 95fpkt", shape=rectangle, color=red];
1018[label="200.79.10.152s;95pkt 95fpkt", shape=ellipse, color=green];
stat285[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.79.10.152:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
418--1018[label="1;95pkt 95fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="200.79.10.152" src_port="1027"/>
    </slice>
    <from sec="1041397575" usec="0"/>
    <to sec="1041397590" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_286{
style=filled;
color=gray75;
419[label="213.209.161.152s;63pkt 63fpkt", shape=rectangle, color=red];
1019[label="213.209.161.152s;63pkt 63fpkt", shape=ellipse, color=green];
stat286[shape=component, label=&lt;Rules:&lt;BR/&gt;{213.209.161.152:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
419--1019[label="1;63pkt 63fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="213.209.161.152" src_port="1026"/>
    </slice>
    <from sec="1041398615" usec="0"/>
    <to sec="1041398629" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.770694,1.8419,002,1 1 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_287{
style=filled;
color=gray75;
423[label="90.38.140.154s;129pkt 129fpkt", shape=rectangle, color=red];
1022[label="90.38.140.154s;129pkt 129fpkt", shape=ellipse, color=green];
4032[label="90.38.140.154;128pkt 128fpkt", shape=pentagon, color=darkviolet];
4792[label="90.38.140.154;129pkt 129fpkt", shape=invtriangle, color=brown];
stat287[shape=component, label=&lt;Rules:&lt;BR/&gt;{90.38.140.154:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
423--1022[label="1;129pkt 129fpkt"];
423--4032[label="1;128pkt 128fpkt"];
423--4792[label="1;129pkt 129fpkt"];
1022--4032[label="1;128pkt 128fpkt"];
1022--4792[label="1;129pkt 129fpkt"];
4032--4792[label="1;128pkt 128fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="90.38.140.154" src_port="1027"/>
    </slice>
    <from sec="1041398549" usec="0"/>
    <to sec="1041398578" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_288{
style=filled;
color=gray75;
424[label="61.143.216.154s;144pkt 144fpkt", shape=rectangle, color=red];
1023[label="61.143.216.154s;113pkt 113fpkt", shape=ellipse, color=green];
1469[label="61.143.216.154s;113pkt 113fpkt", shape=triangle, color=blue];
stat288[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.143.216.154:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
424--1023[label="1;113pkt 113fpkt"];
424--1469[label="1;113pkt 113fpkt"];
1023--1469[label="1;113pkt 113fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.143.216.154" src_port="1026"/>
    </slice>
    <from sec="1041398204" usec="0"/>
    <to sec="1041398234" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.02037,1.88019,002,1 1 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_289{
style=filled;
color=gray75;
425[label="91.84.134.155s;186pkt 186fpkt", shape=rectangle, color=red];
1024[label="91.84.134.155s;186pkt 186fpkt", shape=ellipse, color=green];
4037[label="91.84.134.155;210pkt 210fpkt", shape=pentagon, color=darkviolet];
4796[label="91.84.134.155;211pkt 211fpkt", shape=invtriangle, color=brown];
5190[label="91.84.134.155;211pkt 211fpkt", shape=invhouse, color=bisque];
stat289[shape=component, label=&lt;Rules:&lt;BR/&gt;{91.84.134.155:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
425--1024[label="1;186pkt 186fpkt"];
425--4037[label="0.994624;185pkt 185fpkt"];
425--4796[label="1;186pkt 186fpkt"];
425--5190[label="1;186pkt 186fpkt"];
1024--4037[label="0.994624;185pkt 185fpkt"];
1024--4796[label="1;186pkt 186fpkt"];
1024--5190[label="1;186pkt 186fpkt"];
4037--4796[label="1;210pkt 210fpkt"];
4037--5190[label="1;210pkt 210fpkt"];
4796--5190[label="1;211pkt 211fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="91.84.134.155" src_port="1029"/>
    </slice>
    <from sec="1041397557" usec="0"/>
    <to sec="1041397589" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_290{
style=filled;
color=gray75;
426[label="200.78.140.155s;175pkt 175fpkt", shape=rectangle, color=red];
1025[label="200.78.140.155s;175pkt 175fpkt", shape=ellipse, color=green];
1470[label="200.78.140.155s;88pkt 88fpkt", shape=triangle, color=blue];
4038[label="200.78.140.155;189pkt 189fpkt", shape=pentagon, color=darkviolet];
4797[label="200.78.140.155;188pkt 188fpkt", shape=invtriangle, color=brown];
stat290[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.78.140.155:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
426--1025[label="1;175pkt 175fpkt"];
426--1470[label="1;88pkt 88fpkt"];
426--4038[label="1;175pkt 175fpkt"];
426--4797[label="0.994286;174pkt 174fpkt"];
1025--1470[label="1;88pkt 88fpkt"];
1025--4038[label="1;175pkt 175fpkt"];
1025--4797[label="0.994286;174pkt 174fpkt"];
1470--4038[label="1;88pkt 88fpkt"];
1470--4797[label="0.988636;87pkt 87fpkt"];
4038--4797[label="1;188pkt 188fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="200.78.140.155" src_port="1027"/>
    </slice>
    <from sec="1041398409" usec="0"/>
    <to sec="1041398441" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_291{
style=filled;
color=gray75;
430[label="217.22.12.157s;234pkt 234fpkt", shape=rectangle, color=red];
1028[label="217.22.12.157s;234pkt 234fpkt", shape=ellipse, color=green];
1472[label="217.22.12.157s;212pkt 212fpkt", shape=triangle, color=blue];
stat291[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.22.12.157:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
430--1028[label="1;234pkt 234fpkt"];
430--1472[label="1;212pkt 212fpkt"];
1028--1472[label="1;212pkt 212fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.22.12.157" src_port="1026"/>
    </slice>
    <from sec="1041398245" usec="0"/>
    <to sec="1041398282" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_292{
style=filled;
color=gray75;
431[label="70.177.64.157s;213pkt 213fpkt", shape=rectangle, color=red];
1029[label="70.177.64.157s;213pkt 213fpkt", shape=ellipse, color=green];
stat292[shape=component, label=&lt;Rules:&lt;BR/&gt;{70.177.64.157:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
431--1029[label="1;213pkt 213fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="70.177.64.157" src_port="1028"/>
    </slice>
    <from sec="1041397635" usec="0"/>
    <to sec="1041397671" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_293{
style=filled;
color=gray75;
433[label="61.228.134.157s;112pkt 112fpkt", shape=rectangle, color=red];
1031[label="61.228.134.157s;112pkt 112fpkt", shape=ellipse, color=green];
stat293[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.228.134.157:1062, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1062: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
433--1031[label="1;112pkt 112fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.228.134.157" src_port="1062"/>
    </slice>
    <from sec="1041398649" usec="0"/>
    <to sec="1041398666" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.649115,1.85851,002,1 1 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_294{
style=filled;
color=gray75;
435[label="61.208.193.158s;131pkt 131fpkt", shape=rectangle, color=red];
1033[label="61.208.193.158s;99pkt 99fpkt", shape=ellipse, color=green];
4052[label="61.208.193.158;129pkt 129fpkt", shape=pentagon, color=darkviolet];
stat294[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.208.193.158:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
435--1033[label="1;99pkt 99fpkt"];
435--3285[label="0.671756;88pkt 88fpkt"];
435--4052[label="1;129pkt 129fpkt"];
1033--3285[label="0.888889;88pkt 88fpkt"];
1033--4052[label="0.989899;98pkt 98fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.208.193.158" src_port="1027"/>
    </slice>
    <from sec="1041398722" usec="0"/>
    <to sec="1041398745" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_295{
style=filled;
color=gray75;
439[label="61.114.137.159s;256pkt 256fpkt", shape=rectangle, color=red];
1036[label="61.114.137.159s;256pkt 256fpkt", shape=ellipse, color=green];
1478[label="61.114.137.159s;256pkt 256fpkt", shape=triangle, color=blue];
4057[label="61.114.137.159;256pkt 256fpkt", shape=pentagon, color=darkviolet];
4806[label="61.114.137.159;255pkt 255fpkt", shape=invtriangle, color=brown];
stat295[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.114.137.159:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
439--1036[label="1;256pkt 256fpkt"];
439--1478[label="1;256pkt 256fpkt"];
439--4057[label="1;256pkt 256fpkt"];
439--4806[label="1;255pkt 255fpkt"];
1036--1478[label="1;256pkt 256fpkt"];
1036--4057[label="1;256pkt 256fpkt"];
1036--4806[label="1;255pkt 255fpkt"];
1478--4057[label="1;256pkt 256fpkt"];
1478--4806[label="1;255pkt 255fpkt"];
4057--4806[label="1;255pkt 255fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.114.137.159" src_port="1026"/>
    </slice>
    <from sec="1041397940" usec="0"/>
    <to sec="1041397959" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_296{
style=filled;
color=gray75;
440[label="211.226.165.160s;208pkt 208fpkt", shape=rectangle, color=red];
1037[label="211.226.165.160s;152pkt 152fpkt", shape=ellipse, color=green];
stat296[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.226.165.160:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
440--1037[label="1;152pkt 152fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="211.226.165.160" src_port="1027"/>
    </slice>
    <from sec="1041398017" usec="0"/>
    <to sec="1041398058" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_297{
style=filled;
color=gray75;
442[label="217.35.17.161s;80pkt 80fpkt", shape=rectangle, color=red];
1039[label="217.35.17.161s;80pkt 80fpkt", shape=ellipse, color=green];
1480[label="217.35.17.161s;80pkt 80fpkt", shape=triangle, color=blue];
stat297[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.35.17.161:1065, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1065: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
442--1039[label="1;80pkt 80fpkt"];
442--1480[label="1;80pkt 80fpkt"];
1039--1480[label="1;80pkt 80fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.35.17.161" src_port="1065"/>
    </slice>
    <from sec="1041397387" usec="0"/>
    <to sec="1041397401" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_298{
style=filled;
color=gray75;
443[label="202.108.67.161s;131pkt 131fpkt", shape=rectangle, color=red];
444[label="217.66.95.161s;95pkt 95fpkt", shape=rectangle, color=red];
1040[label="217.66.95.161s;174pkt 174fpkt", shape=ellipse, color=green];
stat298[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.108.67.161:1026, *:137}[57.9646%]&lt;BR/&gt;{217.66.95.161:1025, *:137}[42.0354%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 1026: (26.25%)&lt;BR/&gt; 1025: (23.75%)&gt;];
}
443--1040[label="0.603053;79pkt 79fpkt"];
444--1040[label="1;95pkt 95fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="202.108.67.161" src_port="1026"/>
      <filter dst_port="137" src_ip="217.66.95.161" src_port="1025"/>
    </slice>
    <from sec="1041397842" usec="0"/>
    <to sec="1041397870" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,999,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_299{
style=filled;
color=gray75;
449[label="63.98.50.164s;1pkt 1fpkt", shape=rectangle, color=red];
1044[label="63.98.50.164s;1pkt 1fpkt", shape=ellipse, color=green];
1483[label="63.98.50.164s;1pkt 1fpkt", shape=triangle, color=blue];
4079[label="89.16.130.164;21pkt 21fpkt", shape=pentagon, color=darkviolet];
stat299[shape=component, label=&lt;Rules:&lt;BR/&gt;{89.16.130.164:25, 172.142.201.149:*}[71.4286%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 2913: (8.33333%)&lt;BR/&gt; 55502: (2.08333%)&lt;BR/&gt; 49892: (2.08333%)&lt;BR/&gt; 4964: (2.08333%)&gt;];
}
449--1044[label="1;1pkt 1fpkt"];
449--1483[label="1;1pkt 1fpkt"];
449--4079[label="1;1pkt 1fpkt"];
1044--1483[label="1;1pkt 1fpkt"];
1044--4079[label="1;1pkt 1fpkt"];
1483--4079[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="172.142.201.149" src_ip="89.16.130.164" src_port="25"/>
    </slice>
    <from sec="1041397274" usec="0"/>
    <to sec="1041398178" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_300{
style=filled;
color=gray75;
452[label="91.33.28.167s;138pkt 138fpkt", shape=rectangle, color=red];
1046[label="91.33.28.167s;119pkt 119fpkt", shape=ellipse, color=green];
1486[label="91.33.28.167s;119pkt 119fpkt", shape=triangle, color=blue];
4088[label="91.33.28.167;138pkt 138fpkt", shape=pentagon, color=darkviolet];
4819[label="91.33.28.167;138pkt 138fpkt", shape=invtriangle, color=brown];
stat300[shape=component, label=&lt;Rules:&lt;BR/&gt;{91.33.28.167:1045, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1045: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
452--1046[label="1;119pkt 119fpkt"];
452--1486[label="1;119pkt 119fpkt"];
452--4088[label="1;138pkt 138fpkt"];
452--4819[label="1;138pkt 138fpkt"];
1046--1486[label="1;119pkt 119fpkt"];
1046--4088[label="1;119pkt 119fpkt"];
1046--4819[label="1;119pkt 119fpkt"];
1486--4088[label="1;119pkt 119fpkt"];
1486--4819[label="1;119pkt 119fpkt"];
4088--4819[label="1;138pkt 138fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="91.33.28.167" src_port="1045"/>
    </slice>
    <from sec="1041397878" usec="0"/>
    <to sec="1041397899" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_301{
style=filled;
color=gray75;
453[label="217.84.70.168s;120pkt 120fpkt", shape=rectangle, color=red];
1047[label="217.84.70.168s;77pkt 77fpkt", shape=ellipse, color=green];
stat301[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.84.70.168:1087, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1087: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
453--1047[label="1;77pkt 77fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.84.70.168" src_port="1087"/>
    </slice>
    <from sec="1041397521" usec="0"/>
    <to sec="1041397546" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.770694,1.8419,002,1 1 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_302{
style=filled;
color=gray75;
455[label="70.128.184.168s;178pkt 178fpkt", shape=rectangle, color=red];
1049[label="70.128.184.168s;91pkt 91fpkt", shape=ellipse, color=green];
4092[label="70.128.184.168;177pkt 177fpkt", shape=pentagon, color=darkviolet];
4821[label="70.128.184.168;178pkt 178fpkt", shape=invtriangle, color=brown];
stat302[shape=component, label=&lt;Rules:&lt;BR/&gt;{70.128.184.168:1031, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1031: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
455--1049[label="1;91pkt 91fpkt"];
455--4092[label="1;177pkt 177fpkt"];
455--4821[label="1;178pkt 178fpkt"];
1049--4092[label="1;91pkt 91fpkt"];
1049--4821[label="1;91pkt 91fpkt"];
4092--4821[label="1;177pkt 177fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="70.128.184.168" src_port="1031"/>
    </slice>
    <from sec="1041398784" usec="0"/>
    <to sec="1041398818" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_303{
style=filled;
color=gray75;
459[label="4.131.115.169s;56pkt 56fpkt", shape=rectangle, color=red];
1051[label="4.131.115.169s;56pkt 56fpkt", shape=ellipse, color=green];
stat303[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.131.115.169:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
459--1051[label="1;56pkt 56fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="4.131.115.169" src_port="1026"/>
    </slice>
    <from sec="1041397456" usec="0"/>
    <to sec="1041397469" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.620401,1.94046,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="219.12.97.170" src_port="1031"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="219.12.97.170" src_port="1031"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="219.12.97.170" src_port="80"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="219.12.97.170" src_port="80"/>
      <from sec="1041398175" usec="0"/>
      <to sec="1041398190" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="208.153.81.170" src_port="1031"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="208.153.81.170" src_port="1031"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="208.153.81.170" src_port="80"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="208.153.81.170" src_port="80"/>
      <from sec="1041398182" usec="0"/>
      <to sec="1041398189" usec="0"/>
    </slice>
    <from sec="1041398175" usec="0"/>
    <to sec="1041398190" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_305{
style=filled;
color=gray75;
464[label="116.29.134.171s;199pkt 199fpkt", shape=rectangle, color=red];
1054[label="116.29.134.171s;199pkt 199fpkt", shape=ellipse, color=green];
1490[label="116.29.134.171s;142pkt 142fpkt", shape=triangle, color=blue];
stat305[shape=component, label=&lt;Rules:&lt;BR/&gt;{116.29.134.171:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
464--1054[label="1;199pkt 199fpkt"];
464--1490[label="1;142pkt 142fpkt"];
1054--1490[label="1;142pkt 142fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="116.29.134.171" src_port="1027"/>
    </slice>
    <from sec="1041397435" usec="0"/>
    <to sec="1041397466" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.649115,1.85851,002,1 1 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_306{
style=filled;
color=gray75;
230[label="90.18.149.67s;374pkt 374fpkt", shape=rectangle, color=red];
465[label="61.99.194.172s;167pkt 167fpkt", shape=rectangle, color=red];
865[label="90.18.149.67s;374pkt 374fpkt", shape=ellipse, color=green];
1055[label="61.99.194.172s;167pkt 167fpkt", shape=ellipse, color=green];
3634[label="90.18.149.67;256pkt 256fpkt", shape=pentagon, color=darkviolet];
4113[label="61.99.194.172;183pkt 183fpkt", shape=pentagon, color=darkviolet];
stat306[shape=component, label=&lt;Rules:&lt;BR/&gt;{90.18.149.67:1027, *:137}[58.3144%]&lt;BR/&gt;{61.99.194.172:1046, *:137}[41.6856%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 1027: (25.2465%)&lt;BR/&gt; 1046: (24.7535%)&gt;];
}
230--465[label="0.610778;102pkt 102fpkt"];
230--865[label="1;374pkt 374fpkt"];
230--1055[label="0.610778;102pkt 102fpkt"];
230--1357[label="0.684492;256pkt 256fpkt"];
230--3634[label="1;256pkt 256fpkt"];
230--4113[label="0.644809;118pkt 118fpkt"];
465--865[label="0.610778;102pkt 102fpkt"];
465--1055[label="1;167pkt 167fpkt"];
465--4113[label="1;167pkt 167fpkt"];
865--1055[label="0.610778;102pkt 102fpkt"];
865--1357[label="0.684492;256pkt 256fpkt"];
865--3634[label="1;256pkt 256fpkt"];
865--4113[label="0.644809;118pkt 118fpkt"];
1055--4113[label="1;167pkt 167fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="90.18.149.67" src_port="1027"/>
      <filter dst_port="137" src_ip="61.99.194.172" src_port="1046"/>
    </slice>
    <from sec="1041397658" usec="0"/>
    <to sec="1041397701" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_307{
style=filled;
color=gray75;
466[label="61.136.219.173s;184pkt 184fpkt", shape=rectangle, color=red];
1056[label="61.136.219.173s;184pkt 184fpkt", shape=ellipse, color=green];
1491[label="61.136.219.173s;75pkt 75fpkt", shape=triangle, color=blue];
4118[label="61.136.219.173;183pkt 183fpkt", shape=pentagon, color=darkviolet];
4833[label="61.136.219.173;183pkt 183fpkt", shape=invtriangle, color=brown];
5205[label="61.136.219.173;184pkt 184fpkt", shape=invhouse, color=bisque];
stat307[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.136.219.173:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
466--1056[label="1;184pkt 184fpkt"];
466--1491[label="1;75pkt 75fpkt"];
466--4118[label="1;183pkt 183fpkt"];
466--4833[label="1;183pkt 183fpkt"];
466--5205[label="1;184pkt 184fpkt"];
1056--1491[label="1;75pkt 75fpkt"];
1056--4118[label="1;183pkt 183fpkt"];
1056--4833[label="1;183pkt 183fpkt"];
1056--5205[label="1;184pkt 184fpkt"];
1491--4118[label="1;75pkt 75fpkt"];
1491--4833[label="1;75pkt 75fpkt"];
1491--5205[label="1;75pkt 75fpkt"];
4118--4833[label="1;183pkt 183fpkt"];
4118--5205[label="1;183pkt 183fpkt"];
4833--5205[label="1;183pkt 183fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.136.219.173" src_port="1027"/>
    </slice>
    <from sec="1041398248" usec="0"/>
    <to sec="1041398279" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_308{
style=filled;
color=gray75;
468[label="61.164.88.174s;174pkt 174fpkt", shape=rectangle, color=red];
1058[label="61.164.88.174s;174pkt 174fpkt", shape=ellipse, color=green];
1493[label="61.164.88.174s;90pkt 90fpkt", shape=triangle, color=blue];
4121[label="61.164.88.174;192pkt 192fpkt", shape=pentagon, color=darkviolet];
stat308[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.164.88.174:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
468--1058[label="1;174pkt 174fpkt"];
468--1493[label="1;90pkt 90fpkt"];
468--4121[label="1;174pkt 174fpkt"];
1058--1493[label="1;90pkt 90fpkt"];
1058--4121[label="1;174pkt 174fpkt"];
1493--4121[label="1;90pkt 90fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.164.88.174" src_port="1027"/>
    </slice>
    <from sec="1041398188" usec="0"/>
    <to sec="1041398736" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_309{
style=filled;
color=gray75;
469[label="93.229.73.175s;112pkt 112fpkt", shape=rectangle, color=red];
1059[label="93.229.73.175s;56pkt 56fpkt", shape=ellipse, color=green];
stat309[shape=component, label=&lt;Rules:&lt;BR/&gt;{93.229.73.175:1031, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1031: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
469--1059[label="1;56pkt 56fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="93.229.73.175" src_port="1031"/>
    </slice>
    <from sec="1041398207" usec="0"/>
    <to sec="1041398234" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_310{
style=filled;
color=gray75;
470[label="217.74.143.175s;83pkt 83fpkt", shape=rectangle, color=red];
1060[label="217.74.143.175s;83pkt 83fpkt", shape=ellipse, color=green];
stat310[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.74.143.175:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
470--1060[label="1;83pkt 83fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.74.143.175" src_port="1029"/>
    </slice>
    <from sec="1041397342" usec="0"/>
    <to sec="1041397356" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_311{
style=filled;
color=gray75;
472[label="61.198.23.177s;202pkt 202fpkt", shape=rectangle, color=red];
1062[label="61.198.23.177s;104pkt 104fpkt", shape=ellipse, color=green];
1495[label="61.198.23.177s;104pkt 104fpkt", shape=triangle, color=blue];
4127[label="61.198.23.177;246pkt 246fpkt", shape=pentagon, color=darkviolet];
4839[label="61.198.23.177;246pkt 246fpkt", shape=invtriangle, color=brown];
5206[label="61.198.23.177;247pkt 247fpkt", shape=invhouse, color=bisque];
stat311[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.198.23.177:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
472--1062[label="1;104pkt 104fpkt"];
472--1495[label="1;104pkt 104fpkt"];
472--3276[label="0.450495;91pkt 91fpkt"];
472--3290[label="0.450495;91pkt 91fpkt"];
472--3299[label="0.450495;91pkt 91fpkt"];
472--4127[label="0.99505;201pkt 201fpkt"];
472--4839[label="0.99505;201pkt 201fpkt"];
472--5206[label="1;202pkt 202fpkt"];
1062--1495[label="1;104pkt 104fpkt"];
1062--3276[label="0.875;91pkt 91fpkt"];
1062--3290[label="0.875;91pkt 91fpkt"];
1062--3299[label="0.875;91pkt 91fpkt"];
1062--4127[label="1;104pkt 104fpkt"];
1062--4839[label="1;104pkt 104fpkt"];
1062--5206[label="1;104pkt 104fpkt"];
1495--3276[label="0.875;91pkt 91fpkt"];
1495--3290[label="0.875;91pkt 91fpkt"];
1495--3299[label="0.875;91pkt 91fpkt"];
1495--4127[label="1;104pkt 104fpkt"];
1495--4839[label="1;104pkt 104fpkt"];
1495--5206[label="1;104pkt 104fpkt"];
4127--4839[label="1;246pkt 246fpkt"];
4127--5206[label="1;246pkt 246fpkt"];
4839--5206[label="1;246pkt 246fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.198.23.177" src_port="1026"/>
    </slice>
    <from sec="1041397228" usec="0"/>
    <to sec="1041397318" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_312{
style=filled;
color=gray75;
473[label="210.168.165.177s;66pkt 66fpkt", shape=rectangle, color=red];
1063[label="210.168.165.177s;66pkt 66fpkt", shape=ellipse, color=green];
1496[label="210.168.165.177s;66pkt 66fpkt", shape=triangle, color=blue];
4129[label="210.168.165.177;109pkt 109fpkt", shape=pentagon, color=darkviolet];
stat312[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.168.165.177:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
473--1063[label="1;66pkt 66fpkt"];
473--1496[label="1;66pkt 66fpkt"];
473--4129[label="1;66pkt 66fpkt"];
1063--1496[label="1;66pkt 66fpkt"];
1063--4129[label="1;66pkt 66fpkt"];
1496--4129[label="1;66pkt 66fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="210.168.165.177" src_port="1025"/>
    </slice>
    <from sec="1041398704" usec="0"/>
    <to sec="1041398729" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_313{
style=filled;
color=gray75;
475[label="4.68.28.179s;72pkt 72fpkt", shape=rectangle, color=red];
1064[label="4.68.28.179s;72pkt 72fpkt", shape=ellipse, color=green];
stat313[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.68.28.179:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
475--1064[label="1;72pkt 72fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="4.68.28.179" src_port="1028"/>
    </slice>
    <from sec="1041397483" usec="0"/>
    <to sec="1041397499" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_314{
style=filled;
color=gray75;
478[label="61.98.199.180s;217pkt 217fpkt", shape=rectangle, color=red];
1066[label="61.98.199.180s;159pkt 159fpkt", shape=ellipse, color=green];
1497[label="61.98.199.180s;77pkt 77fpkt", shape=triangle, color=blue];
4139[label="61.98.199.180;217pkt 217fpkt", shape=pentagon, color=darkviolet];
4844[label="61.98.199.180;216pkt 216fpkt", shape=invtriangle, color=brown];
5208[label="61.98.199.180;216pkt 216fpkt", shape=invhouse, color=bisque];
stat314[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.98.199.180:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
478--1066[label="1;159pkt 159fpkt"];
478--1497[label="1;77pkt 77fpkt"];
478--4139[label="1;217pkt 217fpkt"];
478--4844[label="1;216pkt 216fpkt"];
478--5208[label="1;216pkt 216fpkt"];
1066--1497[label="1;77pkt 77fpkt"];
1066--4139[label="1;159pkt 159fpkt"];
1066--4844[label="1;159pkt 159fpkt"];
1066--5208[label="1;159pkt 159fpkt"];
1497--4139[label="1;77pkt 77fpkt"];
1497--4844[label="1;77pkt 77fpkt"];
1497--5208[label="1;77pkt 77fpkt"];
4139--4844[label="1;216pkt 216fpkt"];
4139--5208[label="1;216pkt 216fpkt"];
4844--5208[label="1;216pkt 216fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.98.199.180" src_port="1026"/>
    </slice>
    <from sec="1041398130" usec="0"/>
    <to sec="1041398175" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_315{
style=filled;
color=gray75;
479[label="202.238.93.181s;255pkt 255fpkt", shape=rectangle, color=red];
1067[label="202.238.93.181s;255pkt 255fpkt", shape=ellipse, color=green];
1498[label="202.238.93.181s;255pkt 255fpkt", shape=triangle, color=blue];
stat315[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.238.93.181:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
479--1067[label="1;255pkt 255fpkt"];
479--1498[label="1;255pkt 255fpkt"];
1067--1498[label="1;255pkt 255fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="202.238.93.181" src_port="1026"/>
    </slice>
    <from sec="1041397341" usec="0"/>
    <to sec="1041397385" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_316{
style=filled;
color=gray75;
480[label="61.98.211.181s;89pkt 89fpkt", shape=rectangle, color=red];
1068[label="61.98.211.181s;89pkt 89fpkt", shape=ellipse, color=green];
1499[label="61.98.211.181s;89pkt 89fpkt", shape=triangle, color=blue];
stat316[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.98.211.181:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
480--1068[label="1;89pkt 89fpkt"];
480--1499[label="1;89pkt 89fpkt"];
1068--1499[label="1;89pkt 89fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.98.211.181" src_port="1026"/>
    </slice>
    <from sec="1041397444" usec="0"/>
    <to sec="1041397457" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_317{
style=filled;
color=gray75;
484[label="61.248.17.183s;196pkt 196fpkt", shape=rectangle, color=red];
1071[label="61.248.17.183s;196pkt 196fpkt", shape=ellipse, color=green];
1501[label="61.248.17.183s;190pkt 190fpkt", shape=triangle, color=blue];
4143[label="61.248.17.183;251pkt 251fpkt", shape=pentagon, color=darkviolet];
4845[label="61.248.17.183;251pkt 251fpkt", shape=invtriangle, color=brown];
stat317[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.248.17.183:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
484--1071[label="1;196pkt 196fpkt"];
484--1501[label="1;190pkt 190fpkt"];
484--4143[label="1;196pkt 196fpkt"];
484--4845[label="1;196pkt 196fpkt"];
1071--1501[label="1;190pkt 190fpkt"];
1071--4143[label="1;196pkt 196fpkt"];
1071--4845[label="1;196pkt 196fpkt"];
1501--4143[label="1;190pkt 190fpkt"];
1501--4845[label="1;190pkt 190fpkt"];
4143--4845[label="1;251pkt 251fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.248.17.183" src_port="1027"/>
    </slice>
    <from sec="1041397304" usec="0"/>
    <to sec="1041397343" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_318{
style=filled;
color=gray75;
485[label="88.33.19.183s;276pkt 276fpkt", shape=rectangle, color=red];
1072[label="88.33.19.183s;194pkt 194fpkt", shape=ellipse, color=green];
1502[label="88.33.19.183s;194pkt 194fpkt", shape=triangle, color=blue];
stat318[shape=component, label=&lt;Rules:&lt;BR/&gt;{88.33.19.183:1027, *:137}[57.2464%]&lt;BR/&gt;{88.33.19.183:1028, *:137}[42.7536%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 1028: (26.6566%)&lt;BR/&gt; 1027: (23.3434%)&gt;];
}
485--1072[label="1;194pkt 194fpkt"];
485--1502[label="1;194pkt 194fpkt"];
1072--1502[label="1;194pkt 194fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="88.33.19.183" src_port="1027"/>
      <filter dst_port="137" src_ip="88.33.19.183" src_port="1028"/>
    </slice>
    <from sec="1041397548" usec="0"/>
    <to sec="1041398649" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.770694,1.8419,002,1 1 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_320{
style=filled;
color=gray75;
490[label="219.104.60.187s;158pkt 158fpkt", shape=rectangle, color=red];
1076[label="219.104.60.187s;122pkt 122fpkt", shape=ellipse, color=green];
4155[label="219.104.60.187;210pkt 210fpkt", shape=pentagon, color=darkviolet];
4854[label="219.104.60.187;210pkt 210fpkt", shape=invtriangle, color=brown];
stat320[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.104.60.187:10000, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 10000: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
490--1076[label="1;122pkt 122fpkt"];
490--4155[label="1;158pkt 158fpkt"];
490--4854[label="1;158pkt 158fpkt"];
1076--4155[label="1;122pkt 122fpkt"];
1076--4854[label="1;122pkt 122fpkt"];
4155--4854[label="1;210pkt 210fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="219.104.60.187" src_port="10000"/>
    </slice>
    <from sec="1041397553" usec="0"/>
    <to sec="1041397592" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_321{
style=filled;
color=gray75;
493[label="88.1.160.188s;211pkt 211fpkt", shape=rectangle, color=red];
1079[label="88.1.160.188s;211pkt 211fpkt", shape=ellipse, color=green];
stat321[shape=component, label=&lt;Rules:&lt;BR/&gt;{88.1.160.188:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
493--1079[label="1;211pkt 211fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="88.1.160.188" src_port="1027"/>
    </slice>
    <from sec="1041397531" usec="0"/>
    <to sec="1041397562" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03392,1.87602,002,1 1 1 0 0 0 0 0 0 1 0 1 ">
    <description>subgraph cluster_322{
style=filled;
color=gray75;
496[label="61.141.57.190s;198pkt 198fpkt", shape=rectangle, color=red];
1080[label="61.141.57.190s;198pkt 198fpkt", shape=ellipse, color=green];
1507[label="61.141.57.190s;191pkt 191fpkt", shape=triangle, color=blue];
4162[label="61.141.57.190;220pkt 220fpkt", shape=pentagon, color=darkviolet];
5214[label="61.141.57.190;197pkt 197fpkt", shape=invhouse, color=bisque];
stat322[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.141.57.190:62297, *:137}[89.1892%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 62297: (48.8048%)&lt;BR/&gt; 62299: (1.19522%)&gt;];
}
496--1080[label="1;198pkt 198fpkt"];
496--1507[label="1;191pkt 191fpkt"];
496--3276[label="0.964646;191pkt 191fpkt"];
496--3290[label="0.964646;191pkt 191fpkt"];
496--3299[label="0.964646;191pkt 191fpkt"];
496--4162[label="0.989899;196pkt 196fpkt"];
496--5214[label="1;197pkt 197fpkt"];
1080--1507[label="1;191pkt 191fpkt"];
1080--3276[label="0.964646;191pkt 191fpkt"];
1080--3290[label="0.964646;191pkt 191fpkt"];
1080--3299[label="0.964646;191pkt 191fpkt"];
1080--4162[label="0.989899;196pkt 196fpkt"];
1080--5214[label="1;197pkt 197fpkt"];
1507--3276[label="1;191pkt 191fpkt"];
1507--3290[label="1;191pkt 191fpkt"];
1507--3299[label="1;191pkt 191fpkt"];
1507--4162[label="0.989529;189pkt 189fpkt"];
1507--5214[label="0.994764;190pkt 190fpkt"];
4162--5214[label="0.994924;196pkt 196fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.141.57.190" src_port="62297"/>
    </slice>
    <from sec="1041397217" usec="0"/>
    <to sec="1041397396" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_323{
style=filled;
color=gray75;
497[label="217.19.217.190s;132pkt 132fpkt", shape=rectangle, color=red];
1081[label="217.19.217.190s;102pkt 102fpkt", shape=ellipse, color=green];
1508[label="217.19.217.190s;102pkt 102fpkt", shape=triangle, color=blue];
stat323[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.19.217.190:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
497--1081[label="1;102pkt 102fpkt"];
497--1508[label="1;102pkt 102fpkt"];
1081--1508[label="1;102pkt 102fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.19.217.190" src_port="1029"/>
    </slice>
    <from sec="1041398584" usec="0"/>
    <to sec="1041398605" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.770694,1.8419,002,1 1 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_324{
style=filled;
color=gray75;
498[label="211.57.133.191s;158pkt 158fpkt", shape=rectangle, color=red];
1082[label="211.57.133.191s;158pkt 158fpkt", shape=ellipse, color=green];
4164[label="211.57.133.191;158pkt 158fpkt", shape=pentagon, color=darkviolet];
4860[label="211.57.133.191;157pkt 157fpkt", shape=invtriangle, color=brown];
stat324[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.57.133.191:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
498--1082[label="1;158pkt 158fpkt"];
498--3280[label="1;158pkt 158fpkt"];
498--3295[label="1;158pkt 158fpkt"];
498--4164[label="1;158pkt 158fpkt"];
498--4860[label="1;157pkt 157fpkt"];
1082--3280[label="1;158pkt 158fpkt"];
1082--3295[label="1;158pkt 158fpkt"];
1082--4164[label="1;158pkt 158fpkt"];
1082--4860[label="1;157pkt 157fpkt"];
4164--4860[label="1;157pkt 157fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="211.57.133.191" src_port="1027"/>
    </slice>
    <from sec="1041398461" usec="0"/>
    <to sec="1041398485" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_325{
style=filled;
color=gray75;
499[label="61.165.69.192s;116pkt 116fpkt", shape=rectangle, color=red];
1083[label="61.165.69.192s;116pkt 116fpkt", shape=ellipse, color=green];
1509[label="61.165.69.192s;116pkt 116fpkt", shape=triangle, color=blue];
4165[label="61.165.69.192;158pkt 158fpkt", shape=pentagon, color=darkviolet];
stat325[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.165.69.192:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
499--1083[label="1;116pkt 116fpkt"];
499--1509[label="1;116pkt 116fpkt"];
499--4165[label="1;116pkt 116fpkt"];
1083--1509[label="1;116pkt 116fpkt"];
1083--4165[label="1;116pkt 116fpkt"];
1509--4165[label="1;116pkt 116fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.165.69.192" src_port="1028"/>
    </slice>
    <from sec="1041397629" usec="0"/>
    <to sec="1041397656" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_326{
style=filled;
color=gray75;
500[label="61.243.1.193s;256pkt 256fpkt", shape=rectangle, color=red];
1084[label="61.243.1.193s;256pkt 256fpkt", shape=ellipse, color=green];
1510[label="61.243.1.193s;256pkt 256fpkt", shape=triangle, color=blue];
4173[label="61.243.1.193;255pkt 255fpkt", shape=pentagon, color=darkviolet];
4864[label="61.243.1.193;255pkt 255fpkt", shape=invtriangle, color=brown];
stat326[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.243.1.193:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
500--1084[label="1;256pkt 256fpkt"];
500--1510[label="1;256pkt 256fpkt"];
500--4173[label="1;255pkt 255fpkt"];
500--4864[label="1;255pkt 255fpkt"];
1084--1510[label="1;256pkt 256fpkt"];
1084--4173[label="1;255pkt 255fpkt"];
1084--4864[label="1;255pkt 255fpkt"];
1510--4173[label="1;255pkt 255fpkt"];
1510--4864[label="1;255pkt 255fpkt"];
4173--4864[label="1;255pkt 255fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.243.1.193" src_port="1026"/>
    </slice>
    <from sec="1041397405" usec="0"/>
    <to sec="1041397424" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_327{
style=filled;
color=gray75;
501[label="4.149.51.193s;181pkt 181fpkt", shape=rectangle, color=red];
1085[label="4.149.51.193s;181pkt 181fpkt", shape=ellipse, color=green];
1511[label="4.149.51.193s;88pkt 88fpkt", shape=triangle, color=blue];
4174[label="4.149.51.193;206pkt 206fpkt", shape=pentagon, color=darkviolet];
4865[label="4.149.51.193;205pkt 205fpkt", shape=invtriangle, color=brown];
stat327[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.149.51.193:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
501--1085[label="1;181pkt 181fpkt"];
501--1511[label="1;88pkt 88fpkt"];
501--4174[label="1;181pkt 181fpkt"];
501--4865[label="0.994475;180pkt 180fpkt"];
1085--1511[label="1;88pkt 88fpkt"];
1085--4174[label="1;181pkt 181fpkt"];
1085--4865[label="0.994475;180pkt 180fpkt"];
1511--4174[label="1;88pkt 88fpkt"];
1511--4865[label="1;88pkt 88fpkt"];
4174--4865[label="1;205pkt 205fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="4.149.51.193" src_port="1025"/>
    </slice>
    <from sec="1041397369" usec="0"/>
    <to sec="1041397401" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_328{
style=filled;
color=gray75;
504[label="61.204.131.195s;133pkt 133fpkt", shape=rectangle, color=red];
1086[label="61.204.131.195s;133pkt 133fpkt", shape=ellipse, color=green];
1512[label="61.204.131.195s;133pkt 133fpkt", shape=triangle, color=blue];
4180[label="61.204.131.195;132pkt 132fpkt", shape=pentagon, color=darkviolet];
4870[label="61.204.131.195;133pkt 133fpkt", shape=invtriangle, color=brown];
stat328[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.204.131.195:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
504--1086[label="1;133pkt 133fpkt"];
504--1512[label="1;133pkt 133fpkt"];
504--4180[label="1;132pkt 132fpkt"];
504--4870[label="1;133pkt 133fpkt"];
1086--1512[label="1;133pkt 133fpkt"];
1086--4180[label="1;132pkt 132fpkt"];
1086--4870[label="1;133pkt 133fpkt"];
1512--4180[label="1;132pkt 132fpkt"];
1512--4870[label="1;133pkt 133fpkt"];
4180--4870[label="1;132pkt 132fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.204.131.195" src_port="1025"/>
    </slice>
    <from sec="1041397268" usec="0"/>
    <to sec="1041397291" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_329{
style=filled;
color=gray75;
512[label="4.28.197.199s;241pkt 241fpkt", shape=rectangle, color=red];
1090[label="4.28.197.199s;192pkt 192fpkt", shape=ellipse, color=green];
stat329[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.28.197.199:1034, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1034: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
512--1090[label="1;192pkt 192fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="4.28.197.199" src_port="1034"/>
    </slice>
    <from sec="1041397379" usec="0"/>
    <to sec="1041397415" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_330{
style=filled;
color=gray75;
516[label="61.240.215.202s;163pkt 163fpkt", shape=rectangle, color=red];
1093[label="61.240.215.202s;88pkt 88fpkt", shape=ellipse, color=green];
1518[label="61.240.215.202s;88pkt 88fpkt", shape=triangle, color=blue];
4215[label="61.240.215.202;172pkt 172fpkt", shape=pentagon, color=darkviolet];
4896[label="61.240.215.202;172pkt 172fpkt", shape=invtriangle, color=brown];
stat330[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.240.215.202:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
516--1093[label="1;88pkt 88fpkt"];
516--1518[label="1;88pkt 88fpkt"];
516--3280[label="0.196319;32pkt 32fpkt"];
516--3295[label="0.196319;32pkt 32fpkt"];
516--4215[label="0.993865;162pkt 162fpkt"];
516--4896[label="0.993865;162pkt 162fpkt"];
1093--1518[label="1;88pkt 88fpkt"];
1093--4215[label="0.988636;87pkt 87fpkt"];
1093--4896[label="0.988636;87pkt 87fpkt"];
1518--4215[label="0.988636;87pkt 87fpkt"];
1518--4896[label="0.988636;87pkt 87fpkt"];
4215--4896[label="1;172pkt 172fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.240.215.202" src_port="1025"/>
    </slice>
    <from sec="1041398497" usec="0"/>
    <to sec="1041398531" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_331{
style=filled;
color=gray75;
519[label="70.164.181.203s;141pkt 141fpkt", shape=rectangle, color=red];
1096[label="70.164.181.203s;79pkt 79fpkt", shape=ellipse, color=green];
stat331[shape=component, label=&lt;Rules:&lt;BR/&gt;{70.164.181.203:1031, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1031: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
519--1096[label="1;79pkt 79fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="70.164.181.203" src_port="1031"/>
    </slice>
    <from sec="1041398062" usec="0"/>
    <to sec="1041398089" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,503,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_332{
style=filled;
color=gray75;
521[label="4.174.136.205s;1pkt 1fpkt", shape=rectangle, color=red];
1098[label="4.174.136.205s;1pkt 1fpkt", shape=ellipse, color=green];
1522[label="4.174.136.205s;1pkt 1fpkt", shape=triangle, color=blue];
stat332[shape=component, label=&lt;Rules:&lt;BR/&gt;{144.52.4.205:80, 218.181.218.196:29346}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 29346: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
521--1098[label="1;1pkt 1fpkt"];
521--1522[label="1;1pkt 1fpkt"];
521--2436[label="1;1pkt 1fpkt"];
1098--1522[label="1;1pkt 1fpkt"];
1098--2436[label="1;1pkt 1fpkt"];
1522--2436[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="218.181.218.196" dst_port="29346" src_ip="144.52.4.205" src_port="80"/>
    </slice>
    <from sec="1041397270" usec="0"/>
    <to sec="1041397933" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_333{
style=filled;
color=gray75;
523[label="4.17.48.206s;126pkt 126fpkt", shape=rectangle, color=red];
1099[label="4.17.48.206s;126pkt 126fpkt", shape=ellipse, color=green];
stat333[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.17.48.206:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
523--1099[label="1;126pkt 126fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="4.17.48.206" src_port="1029"/>
    </slice>
    <from sec="1041398009" usec="0"/>
    <to sec="1041398027" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.649115,1.85851,002,1 1 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_334{
style=filled;
color=gray75;
526[label="61.165.85.207s;105pkt 105fpkt", shape=rectangle, color=red];
1101[label="61.165.85.207s;105pkt 105fpkt", shape=ellipse, color=green];
4233[label="61.165.85.207;155pkt 155fpkt", shape=pentagon, color=darkviolet];
stat334[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.165.85.207:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
526--1101[label="1;105pkt 105fpkt"];
526--4233[label="1;105pkt 105fpkt"];
1101--4233[label="1;105pkt 105fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.165.85.207" src_port="1027"/>
    </slice>
    <from sec="1041397882" usec="0"/>
    <to sec="1041397908" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_335{
style=filled;
color=gray75;
527[label="219.27.37.208s;133pkt 133fpkt", shape=rectangle, color=red];
1102[label="219.27.37.208s;133pkt 133fpkt", shape=ellipse, color=green];
1523[label="219.27.37.208s;72pkt 72fpkt", shape=triangle, color=blue];
stat335[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.27.37.208:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
527--1102[label="1;133pkt 133fpkt"];
527--1523[label="1;72pkt 72fpkt"];
1102--1523[label="1;72pkt 72fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="219.27.37.208" src_port="1027"/>
    </slice>
    <from sec="1041397788" usec="0"/>
    <to sec="1041397813" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_336{
style=filled;
color=gray75;
529[label="217.77.116.211s;231pkt 231fpkt", shape=rectangle, color=red];
1103[label="217.77.116.211s;212pkt 212fpkt", shape=ellipse, color=green];
1524[label="217.77.116.211s;212pkt 212fpkt", shape=triangle, color=blue];
stat336[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.77.116.211:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
529--1103[label="1;212pkt 212fpkt"];
529--1524[label="1;212pkt 212fpkt"];
1103--1524[label="1;212pkt 212fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.77.116.211" src_port="1025"/>
    </slice>
    <from sec="1041397684" usec="0"/>
    <to sec="1041397721" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_337{
style=filled;
color=gray75;
530[label="199.108.192.211s;133pkt 133fpkt", shape=rectangle, color=red];
1104[label="199.108.192.211s;84pkt 84fpkt", shape=ellipse, color=green];
1525[label="199.108.192.211s;84pkt 84fpkt", shape=triangle, color=blue];
4247[label="199.108.192.211;133pkt 133fpkt", shape=pentagon, color=darkviolet];
4910[label="199.108.192.211;132pkt 132fpkt", shape=invtriangle, color=brown];
5241[label="199.108.192.211;133pkt 133fpkt", shape=invhouse, color=bisque];
stat337[shape=component, label=&lt;Rules:&lt;BR/&gt;{199.108.192.211:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
530--1104[label="1;84pkt 84fpkt"];
530--1525[label="1;84pkt 84fpkt"];
530--4247[label="1;133pkt 133fpkt"];
530--4910[label="1;132pkt 132fpkt"];
530--5241[label="1;133pkt 133fpkt"];
1104--1525[label="1;84pkt 84fpkt"];
1104--4247[label="1;84pkt 84fpkt"];
1104--4910[label="0.988095;83pkt 83fpkt"];
1104--5241[label="1;84pkt 84fpkt"];
1525--4247[label="1;84pkt 84fpkt"];
1525--4910[label="0.988095;83pkt 83fpkt"];
1525--5241[label="1;84pkt 84fpkt"];
4247--4910[label="1;132pkt 132fpkt"];
4247--5241[label="1;133pkt 133fpkt"];
4910--5241[label="1;132pkt 132fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="199.108.192.211" src_port="1029"/>
    </slice>
    <from sec="1041398287" usec="0"/>
    <to sec="1041398308" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.02037,1.88019,002,1 1 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_338{
style=filled;
color=gray75;
532[label="209.97.88.214s;121pkt 121fpkt", shape=rectangle, color=red];
1106[label="209.97.88.214s;81pkt 81fpkt", shape=ellipse, color=green];
4257[label="209.97.88.214;120pkt 120fpkt", shape=pentagon, color=darkviolet];
4917[label="209.97.88.214;120pkt 120fpkt", shape=invtriangle, color=brown];
5243[label="209.97.88.214;121pkt 121fpkt", shape=invhouse, color=bisque];
stat338[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.97.88.214:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
532--1106[label="1;81pkt 81fpkt"];
532--4257[label="1;120pkt 120fpkt"];
532--4917[label="1;120pkt 120fpkt"];
532--5243[label="1;121pkt 121fpkt"];
1106--4257[label="1;81pkt 81fpkt"];
1106--4917[label="1;81pkt 81fpkt"];
1106--5243[label="1;81pkt 81fpkt"];
4257--4917[label="1;120pkt 120fpkt"];
4257--5243[label="1;120pkt 120fpkt"];
4917--5243[label="1;120pkt 120fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="209.97.88.214" src_port="1025"/>
    </slice>
    <from sec="1041398281" usec="0"/>
    <to sec="1041398307" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_339{
style=filled;
color=gray75;
534[label="202.95.13.215s;210pkt 210fpkt", shape=rectangle, color=red];
1107[label="202.95.13.215s;210pkt 210fpkt", shape=ellipse, color=green];
1527[label="202.95.13.215s;210pkt 210fpkt", shape=triangle, color=blue];
stat339[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.95.13.215:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
534--1107[label="1;210pkt 210fpkt"];
534--1527[label="1;210pkt 210fpkt"];
1107--1527[label="1;210pkt 210fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="202.95.13.215" src_port="1028"/>
    </slice>
    <from sec="1041398585" usec="0"/>
    <to sec="1041398631" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_340{
style=filled;
color=gray75;
535[label="219.171.1.217s;165pkt 165fpkt", shape=rectangle, color=red];
1108[label="219.171.1.217s;106pkt 106fpkt", shape=ellipse, color=green];
1528[label="219.171.1.217s;106pkt 106fpkt", shape=triangle, color=blue];
4272[label="219.171.1.217;165pkt 165fpkt", shape=pentagon, color=darkviolet];
stat340[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.171.1.217:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
535--1108[label="1;106pkt 106fpkt"];
535--1528[label="1;106pkt 106fpkt"];
535--4272[label="1;165pkt 165fpkt"];
1108--1528[label="1;106pkt 106fpkt"];
1108--4272[label="1;106pkt 106fpkt"];
1528--4272[label="1;106pkt 106fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="219.171.1.217" src_port="1027"/>
    </slice>
    <from sec="1041398165" usec="0"/>
    <to sec="1041398190" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_341{
style=filled;
color=gray75;
538[label="203.122.179.217s;116pkt 116fpkt", shape=rectangle, color=red];
1110[label="203.122.179.217s;80pkt 80fpkt", shape=ellipse, color=green];
stat341[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.122.179.217:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
538--1110[label="1;80pkt 80fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="203.122.179.217" src_port="1025"/>
    </slice>
    <from sec="1041398599" usec="0"/>
    <to sec="1041398625" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_342{
style=filled;
color=gray75;
540[label="61.247.85.218s;213pkt 213fpkt", shape=rectangle, color=red];
1111[label="61.247.85.218s;137pkt 137fpkt", shape=ellipse, color=green];
1529[label="61.247.85.218s;137pkt 137fpkt", shape=triangle, color=blue];
stat342[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.247.85.218:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
540--1111[label="1;137pkt 137fpkt"];
540--1529[label="1;137pkt 137fpkt"];
1111--1529[label="1;137pkt 137fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.247.85.218" src_port="1027"/>
    </slice>
    <from sec="1041397429" usec="0"/>
    <to sec="1041397468" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_343{
style=filled;
color=gray75;
541[label="61.136.199.218s;251pkt 251fpkt", shape=rectangle, color=red];
1112[label="61.136.199.218s;251pkt 251fpkt", shape=ellipse, color=green];
1530[label="61.136.199.218s;77pkt 77fpkt", shape=triangle, color=blue];
4279[label="61.136.199.218;251pkt 251fpkt", shape=pentagon, color=darkviolet];
4927[label="61.136.199.218;250pkt 250fpkt", shape=invtriangle, color=brown];
5250[label="61.136.199.218;251pkt 251fpkt", shape=invhouse, color=bisque];
stat343[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.136.199.218:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
541--1112[label="1;251pkt 251fpkt"];
541--1530[label="1;77pkt 77fpkt"];
541--4279[label="1;251pkt 251fpkt"];
541--4927[label="1;250pkt 250fpkt"];
541--5250[label="1;251pkt 251fpkt"];
1112--1530[label="1;77pkt 77fpkt"];
1112--4279[label="1;251pkt 251fpkt"];
1112--4927[label="1;250pkt 250fpkt"];
1112--5250[label="1;251pkt 251fpkt"];
1530--4279[label="1;77pkt 77fpkt"];
1530--4927[label="1;77pkt 77fpkt"];
1530--5250[label="1;77pkt 77fpkt"];
4279--4927[label="1;250pkt 250fpkt"];
4279--5250[label="1;251pkt 251fpkt"];
4927--5250[label="1;250pkt 250fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.136.199.218" src_port="1028"/>
    </slice>
    <from sec="1041398330" usec="0"/>
    <to sec="1041398371" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_344{
style=filled;
color=gray75;
543[label="91.100.2.219s;256pkt 256fpkt", shape=rectangle, color=red];
1114[label="91.100.2.219s;256pkt 256fpkt", shape=ellipse, color=green];
1532[label="91.100.2.219s;397pkt 397fpkt", shape=triangle, color=blue];
4284[label="91.100.2.219;256pkt 256fpkt", shape=pentagon, color=darkviolet];
4930[label="91.100.2.219;256pkt 256fpkt", shape=invtriangle, color=brown];
5253[label="91.100.2.219;256pkt 256fpkt", shape=invhouse, color=bisque];
stat344[shape=component, label=&lt;Rules:&lt;BR/&gt;{91.100.2.219:1025, *:137}[64.4836%]&lt;BR/&gt;{90.137.203.73:1026, *:137}[35.5164%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 1025: (45.7961%)&lt;BR/&gt; 1026: (4.20394%)&gt;];
}
543--1114[label="1;256pkt 256fpkt"];
543--1532[label="1;256pkt 256fpkt"];
543--4284[label="1;256pkt 256fpkt"];
543--4930[label="1;256pkt 256fpkt"];
543--5253[label="1;256pkt 256fpkt"];
1114--1532[label="1;256pkt 256fpkt"];
1114--4284[label="1;256pkt 256fpkt"];
1114--4930[label="1;256pkt 256fpkt"];
1114--5253[label="1;256pkt 256fpkt"];
1532--3664[label="1;140pkt 140fpkt"];
1532--4284[label="1;256pkt 256fpkt"];
1532--4930[label="1;256pkt 256fpkt"];
1532--5253[label="1;256pkt 256fpkt"];
4284--4930[label="1;256pkt 256fpkt"];
4284--5253[label="1;256pkt 256fpkt"];
4930--5253[label="1;256pkt 256fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="91.100.2.219" src_port="1025"/>
      <filter dst_port="137" src_ip="90.137.203.73" src_port="1026"/>
    </slice>
    <from sec="1041397427" usec="0"/>
    <to sec="1041397451" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_345{
style=filled;
color=gray75;
545[label="217.34.50.219s;148pkt 148fpkt", shape=rectangle, color=red];
1116[label="217.34.50.219s;148pkt 148fpkt", shape=ellipse, color=green];
1534[label="217.34.50.219s;148pkt 148fpkt", shape=triangle, color=blue];
4287[label="217.34.50.219;148pkt 148fpkt", shape=pentagon, color=darkviolet];
4932[label="217.34.50.219;148pkt 148fpkt", shape=invtriangle, color=brown];
5255[label="217.34.50.219;148pkt 148fpkt", shape=invhouse, color=bisque];
stat345[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.34.50.219:60229, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 60229: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
545--1116[label="1;148pkt 148fpkt"];
545--1534[label="1;148pkt 148fpkt"];
545--4287[label="1;148pkt 148fpkt"];
545--4932[label="1;148pkt 148fpkt"];
545--5255[label="1;148pkt 148fpkt"];
1116--1534[label="1;148pkt 148fpkt"];
1116--4287[label="1;148pkt 148fpkt"];
1116--4932[label="1;148pkt 148fpkt"];
1116--5255[label="1;148pkt 148fpkt"];
1534--4287[label="1;148pkt 148fpkt"];
1534--4932[label="1;148pkt 148fpkt"];
1534--5255[label="1;148pkt 148fpkt"];
4287--4932[label="1;148pkt 148fpkt"];
4287--5255[label="1;148pkt 148fpkt"];
4932--5255[label="1;148pkt 148fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.34.50.219" src_port="60229"/>
    </slice>
    <from sec="1041397607" usec="0"/>
    <to sec="1041397630" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_346{
style=filled;
color=gray75;
546[label="61.67.105.219s;148pkt 148fpkt", shape=rectangle, color=red];
1117[label="61.67.105.219s;148pkt 148fpkt", shape=ellipse, color=green];
1535[label="61.67.105.219s;79pkt 79fpkt", shape=triangle, color=blue];
4289[label="61.67.105.219;167pkt 167fpkt", shape=pentagon, color=darkviolet];
stat346[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.67.105.219:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
546--1117[label="1;148pkt 148fpkt"];
546--1535[label="1;79pkt 79fpkt"];
546--4289[label="1;148pkt 148fpkt"];
1117--1535[label="1;79pkt 79fpkt"];
1117--4289[label="1;148pkt 148fpkt"];
1535--4289[label="1;79pkt 79fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.67.105.219" src_port="1029"/>
    </slice>
    <from sec="1041397452" usec="0"/>
    <to sec="1041397481" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_348{
style=filled;
color=gray75;
552[label="217.71.166.222s;205pkt 205fpkt", shape=rectangle, color=red];
1121[label="217.71.166.222s;205pkt 205fpkt", shape=ellipse, color=green];
1539[label="217.71.166.222s;205pkt 205fpkt", shape=triangle, color=blue];
stat348[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.71.166.222:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
552--1121[label="1;205pkt 205fpkt"];
552--1539[label="1;205pkt 205fpkt"];
1121--1539[label="1;205pkt 205fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.71.166.222" src_port="1029"/>
    </slice>
    <from sec="1041397753" usec="0"/>
    <to sec="1041397784" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_349{
style=filled;
color=gray75;
553[label="216.241.11.224s;326pkt 326fpkt", shape=rectangle, color=red];
1122[label="216.241.11.224s;121pkt 121fpkt", shape=ellipse, color=green];
1540[label="216.241.11.224s;121pkt 121fpkt", shape=triangle, color=blue];
stat349[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.241.11.224:1026, *:137}[57.9755%]&lt;BR/&gt;{216.241.11.224:1025, *:137}[42.0245%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 1026: (37.9401%)&lt;BR/&gt; 1025: (12.0599%)&gt;];
}
553--1122[label="1;121pkt 121fpkt"];
553--1540[label="1;121pkt 121fpkt"];
553--3280[label="0.380368;124pkt 124fpkt"];
553--3295[label="0.380368;124pkt 124fpkt"];
1122--1540[label="1;121pkt 121fpkt"];
1122--3280[label="0.46281;56pkt 56fpkt"];
1122--3295[label="0.46281;56pkt 56fpkt"];
1540--3280[label="0.46281;56pkt 56fpkt"];
1540--3295[label="0.46281;56pkt 56fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="216.241.11.224" src_port="1026"/>
      <filter dst_port="137" src_ip="216.241.11.224" src_port="1025"/>
    </slice>
    <from sec="1041398450" usec="0"/>
    <to sec="1041398615" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.649115,1.85851,002,1 1 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_350{
style=filled;
color=gray75;
558[label="217.129.11.226s;127pkt 127fpkt", shape=rectangle, color=red];
1125[label="217.129.11.226s;104pkt 104fpkt", shape=ellipse, color=green];
4308[label="217.129.11.226;127pkt 127fpkt", shape=pentagon, color=darkviolet];
stat350[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.129.11.226:1030, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1030: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
558--1125[label="1;104pkt 104fpkt"];
558--1458[label="1;127pkt 127fpkt"];
558--4308[label="1;127pkt 127fpkt"];
1125--1458[label="1;104pkt 104fpkt"];
1125--4308[label="1;104pkt 104fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.129.11.226" src_port="1030"/>
    </slice>
    <from sec="1041397552" usec="0"/>
    <to sec="1041397573" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.649115,1.85851,002,1 1 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_351{
style=filled;
color=gray75;
561[label="61.44.76.227s;232pkt 232fpkt", shape=rectangle, color=red];
1127[label="61.44.76.227s;232pkt 232fpkt", shape=ellipse, color=green];
4313[label="61.44.76.227;236pkt 236fpkt", shape=pentagon, color=darkviolet];
stat351[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.44.76.227:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
561--1127[label="1;232pkt 232fpkt"];
561--4313[label="1;232pkt 232fpkt"];
1127--4313[label="1;232pkt 232fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.44.76.227" src_port="1025"/>
    </slice>
    <from sec="1041397734" usec="0"/>
    <to sec="1041397771" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.770694,1.8419,002,1 1 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_352{
style=filled;
color=gray75;
562[label="205.7.163.227s;250pkt 250fpkt", shape=rectangle, color=red];
1128[label="205.7.163.227s;250pkt 250fpkt", shape=ellipse, color=green];
4316[label="205.7.163.227;250pkt 250fpkt", shape=pentagon, color=darkviolet];
4947[label="205.7.163.227;249pkt 249fpkt", shape=invtriangle, color=brown];
stat352[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.7.163.227:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
562--1128[label="1;250pkt 250fpkt"];
562--4316[label="1;250pkt 250fpkt"];
562--4947[label="1;249pkt 249fpkt"];
1128--4316[label="1;250pkt 250fpkt"];
1128--4947[label="1;249pkt 249fpkt"];
4316--4947[label="1;249pkt 249fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="205.7.163.227" src_port="1027"/>
    </slice>
    <from sec="1041397968" usec="0"/>
    <to sec="1041398007" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_353{
style=filled;
color=gray75;
563[label="61.164.210.227s;69pkt 69fpkt", shape=rectangle, color=red];
1129[label="61.164.210.227s;69pkt 69fpkt", shape=ellipse, color=green];
stat353[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.164.210.227:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
563--1129[label="1;69pkt 69fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.164.210.227" src_port="1025"/>
    </slice>
    <from sec="1041397937" usec="0"/>
    <to sec="1041397950" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_354{
style=filled;
color=gray75;
565[label="156.176.146.228s;78pkt 78fpkt", shape=rectangle, color=red];
1130[label="156.176.146.228s;78pkt 78fpkt", shape=ellipse, color=green];
stat354[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.176.146.228:1030, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1030: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
565--1130[label="1;78pkt 78fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="156.176.146.228" src_port="1030"/>
    </slice>
    <from sec="1041397444" usec="0"/>
    <to sec="1041397457" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_355{
style=filled;
color=gray75;
568[label="91.118.193.230s;203pkt 203fpkt", shape=rectangle, color=red];
1133[label="91.118.193.230s;203pkt 203fpkt", shape=ellipse, color=green];
1546[label="91.118.193.230s;203pkt 203fpkt", shape=triangle, color=blue];
4329[label="91.118.193.230;219pkt 219fpkt", shape=pentagon, color=darkviolet];
4956[label="91.118.193.230;218pkt 218fpkt", shape=invtriangle, color=brown];
stat355[shape=component, label=&lt;Rules:&lt;BR/&gt;{91.118.193.230:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
568--1133[label="1;203pkt 203fpkt"];
568--1546[label="1;203pkt 203fpkt"];
568--4329[label="1;203pkt 203fpkt"];
568--4956[label="0.995074;202pkt 202fpkt"];
1133--1546[label="1;203pkt 203fpkt"];
1133--4329[label="1;203pkt 203fpkt"];
1133--4956[label="0.995074;202pkt 202fpkt"];
1546--4329[label="1;203pkt 203fpkt"];
1546--4956[label="0.995074;202pkt 202fpkt"];
4329--4956[label="1;218pkt 218fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="91.118.193.230" src_port="1028"/>
    </slice>
    <from sec="1041397867" usec="0"/>
    <to sec="1041397901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_356{
style=filled;
color=gray75;
569[label="217.210.181.231s;159pkt 159fpkt", shape=rectangle, color=red];
1134[label="217.210.181.231s;110pkt 110fpkt", shape=ellipse, color=green];
stat356[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.210.181.231:63532, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 63532: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
569--1134[label="1;110pkt 110fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.210.181.231" src_port="63532"/>
    </slice>
    <from sec="1041397882" usec="0"/>
    <to sec="1041397906" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,503,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_357{
style=filled;
color=gray75;
571[label="202.202.166.233s;1pkt 1fpkt", shape=rectangle, color=red];
1136[label="202.202.166.233s;1pkt 1fpkt", shape=ellipse, color=green];
1548[label="202.202.166.233s;1pkt 1fpkt", shape=triangle, color=blue];
stat357[shape=component, label=&lt;Rules:&lt;BR/&gt;{88.177.62.233:80, 202.159.192.34:38991}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 38991: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
571--1136[label="1;1pkt 1fpkt"];
571--1548[label="1;1pkt 1fpkt"];
571--1661[label="1;1pkt 1fpkt"];
1136--1548[label="1;1pkt 1fpkt"];
1136--1661[label="1;1pkt 1fpkt"];
1548--1661[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="202.159.192.34" dst_port="38991" src_ip="88.177.62.233" src_port="80"/>
    </slice>
    <from sec="1041397387" usec="0"/>
    <to sec="1041397415" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_358{
style=filled;
color=gray75;
572[label="200.77.178.233s;212pkt 212fpkt", shape=rectangle, color=red];
1137[label="200.77.178.233s;212pkt 212fpkt", shape=ellipse, color=green];
1549[label="200.77.178.233s;212pkt 212fpkt", shape=triangle, color=blue];
4337[label="200.77.178.233;227pkt 227fpkt", shape=pentagon, color=darkviolet];
stat358[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.77.178.233:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
572--1137[label="1;212pkt 212fpkt"];
572--1549[label="1;212pkt 212fpkt"];
572--4337[label="1;212pkt 212fpkt"];
1137--1549[label="1;212pkt 212fpkt"];
1137--4337[label="1;212pkt 212fpkt"];
1549--4337[label="1;212pkt 212fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="200.77.178.233" src_port="1026"/>
    </slice>
    <from sec="1041398645" usec="0"/>
    <to sec="1041398682" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_359{
style=filled;
color=gray75;
573[label="217.134.47.234s;194pkt 194fpkt", shape=rectangle, color=red];
1138[label="217.134.47.234s;194pkt 194fpkt", shape=ellipse, color=green];
1550[label="217.134.47.234s;194pkt 194fpkt", shape=triangle, color=blue];
stat359[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.134.47.234:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
573--1138[label="1;194pkt 194fpkt"];
573--1550[label="1;194pkt 194fpkt"];
573--3280[label="0.273196;53pkt 53fpkt"];
573--3295[label="0.273196;53pkt 53fpkt"];
1138--1550[label="1;194pkt 194fpkt"];
1138--3280[label="0.273196;53pkt 53fpkt"];
1138--3295[label="0.273196;53pkt 53fpkt"];
1550--3280[label="0.273196;53pkt 53fpkt"];
1550--3295[label="0.273196;53pkt 53fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.134.47.234" src_port="1029"/>
    </slice>
    <from sec="1041398499" usec="0"/>
    <to sec="1041398529" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_360{
style=filled;
color=gray75;
574[label="90.233.67.234s;81pkt 81fpkt", shape=rectangle, color=red];
1139[label="90.233.67.234s;81pkt 81fpkt", shape=ellipse, color=green];
stat360[shape=component, label=&lt;Rules:&lt;BR/&gt;{90.233.67.234:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
574--1139[label="1;81pkt 81fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="90.233.67.234" src_port="1028"/>
    </slice>
    <from sec="1041398696" usec="0"/>
    <to sec="1041398709" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_361{
style=filled;
color=gray75;
576[label="61.234.49.235s;92pkt 92fpkt", shape=rectangle, color=red];
1141[label="61.234.49.235s;92pkt 92fpkt", shape=ellipse, color=green];
1552[label="61.234.49.235s;92pkt 92fpkt", shape=triangle, color=blue];
stat361[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.234.49.235:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
576--1141[label="1;92pkt 92fpkt"];
576--1552[label="1;92pkt 92fpkt"];
1141--1552[label="1;92pkt 92fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.234.49.235" src_port="1027"/>
    </slice>
    <from sec="1041397357" usec="0"/>
    <to sec="1041397372" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_362{
style=filled;
color=gray75;
577[label="70.131.99.235s;139pkt 139fpkt", shape=rectangle, color=red];
1142[label="70.131.99.235s;139pkt 139fpkt", shape=ellipse, color=green];
1553[label="70.131.99.235s;93pkt 93fpkt", shape=triangle, color=blue];
stat362[shape=component, label=&lt;Rules:&lt;BR/&gt;{70.131.99.235:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
577--1142[label="1;139pkt 139fpkt"];
577--1553[label="1;93pkt 93fpkt"];
1142--1553[label="1;93pkt 93fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="70.131.99.235" src_port="1026"/>
    </slice>
    <from sec="1041397401" usec="0"/>
    <to sec="1041397424" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_363{
style=filled;
color=gray75;
578[label="61.253.198.235s;256pkt 256fpkt", shape=rectangle, color=red];
1143[label="61.253.198.235s;256pkt 256fpkt", shape=ellipse, color=green];
1554[label="61.253.198.235s;256pkt 256fpkt", shape=triangle, color=blue];
4340[label="61.253.198.235;256pkt 256fpkt", shape=pentagon, color=darkviolet];
stat363[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.253.198.235:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
578--1143[label="1;256pkt 256fpkt"];
578--1554[label="1;256pkt 256fpkt"];
578--4340[label="1;256pkt 256fpkt"];
1143--1554[label="1;256pkt 256fpkt"];
1143--4340[label="1;256pkt 256fpkt"];
1554--4340[label="1;256pkt 256fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.253.198.235" src_port="1027"/>
    </slice>
    <from sec="1041398304" usec="0"/>
    <to sec="1041398327" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_364{
style=filled;
color=gray75;
580[label="216.241.99.236s;195pkt 195fpkt", shape=rectangle, color=red];
1144[label="216.241.99.236s;171pkt 171fpkt", shape=ellipse, color=green];
1555[label="216.241.99.236s;171pkt 171fpkt", shape=triangle, color=blue];
4344[label="216.241.99.236;195pkt 195fpkt", shape=pentagon, color=darkviolet];
stat364[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.241.99.236:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
580--1144[label="1;171pkt 171fpkt"];
580--1555[label="1;171pkt 171fpkt"];
580--4344[label="1;195pkt 195fpkt"];
1144--1555[label="1;171pkt 171fpkt"];
1144--4344[label="1;171pkt 171fpkt"];
1555--4344[label="1;171pkt 171fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="216.241.99.236" src_port="1029"/>
    </slice>
    <from sec="1041397777" usec="0"/>
    <to sec="1041397812" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.649115,1.85851,002,1 1 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_365{
style=filled;
color=gray75;
581[label="61.252.108.236s;166pkt 166fpkt", shape=rectangle, color=red];
1145[label="61.252.108.236s;166pkt 166fpkt", shape=ellipse, color=green];
4345[label="61.252.108.236;170pkt 170fpkt", shape=pentagon, color=darkviolet];
stat365[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.252.108.236:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
581--1145[label="1;166pkt 166fpkt"];
581--3280[label="1;166pkt 166fpkt"];
581--3295[label="1;166pkt 166fpkt"];
581--4345[label="1;166pkt 166fpkt"];
1145--3280[label="1;166pkt 166fpkt"];
1145--3295[label="1;166pkt 166fpkt"];
1145--4345[label="1;166pkt 166fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.252.108.236" src_port="1025"/>
    </slice>
    <from sec="1041398466" usec="0"/>
    <to sec="1041398495" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_366{
style=filled;
color=gray75;
582[label="61.239.165.236s;224pkt 224fpkt", shape=rectangle, color=red];
1146[label="61.239.165.236s;224pkt 224fpkt", shape=ellipse, color=green];
1556[label="61.239.165.236s;224pkt 224fpkt", shape=triangle, color=blue];
stat366[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.239.165.236:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
582--1146[label="1;224pkt 224fpkt"];
582--1556[label="1;224pkt 224fpkt"];
582--3280[label="0.236607;53pkt 53fpkt"];
582--3295[label="0.236607;53pkt 53fpkt"];
1146--1556[label="1;224pkt 224fpkt"];
1146--3280[label="0.236607;53pkt 53fpkt"];
1146--3295[label="0.236607;53pkt 53fpkt"];
1556--3280[label="0.236607;53pkt 53fpkt"];
1556--3295[label="0.236607;53pkt 53fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.239.165.236" src_port="1027"/>
    </slice>
    <from sec="1041398499" usec="0"/>
    <to sec="1041398533" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,999,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_367{
style=filled;
color=gray75;
583[label="202.222.62.237s;1pkt 1fpkt", shape=rectangle, color=red];
1147[label="202.222.62.237s;1pkt 1fpkt", shape=ellipse, color=green];
stat367[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.142.234.237:1040, 218.159.204.144:5050}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5050: (50%)&lt;BR/&gt; 1040: (50%)&gt;];
}
583--1147[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="218.159.204.144" dst_port="5050" src_ip="172.142.234.237" src_port="1040"/>
    </slice>
    <from sec="1041398110" usec="0"/>
    <to sec="1041398125" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_368{
style=filled;
color=gray75;
587[label="91.24.203.238s;176pkt 176fpkt", shape=rectangle, color=red];
1151[label="91.24.203.238s;125pkt 125fpkt", shape=ellipse, color=green];
stat368[shape=component, label=&lt;Rules:&lt;BR/&gt;{91.24.203.238:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
587--1151[label="1;125pkt 125fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="91.24.203.238" src_port="1029"/>
    </slice>
    <from sec="1041398623" usec="0"/>
    <to sec="1041398649" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.620401,1.94046,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="203.59.21.3" dst_port="137" proto="udp" src_ip="91.33.129.240" src_port="1027"/>
      <filter dst_ip="203.59.21.3" dst_port="53" proto="udp" src_ip="91.33.129.240" src_port="1027"/>
      <from sec="1041398648" usec="0"/>
      <to sec="1041398664" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="203.59.21.3" dst_port="137" proto="udp" src_ip="218.74.197.240" src_port="1027"/>
      <filter dst_ip="203.59.21.3" dst_port="53" proto="udp" src_ip="218.74.197.240" src_port="1027"/>
      <from sec="1041398649" usec="0"/>
      <to sec="1041398656" usec="0"/>
    </slice>
    <from sec="1041398648" usec="0"/>
    <to sec="1041398666" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_371{
style=filled;
color=gray75;
593[label="217.53.140.241s;220pkt 220fpkt", shape=rectangle, color=red];
1156[label="217.53.140.241s;220pkt 220fpkt", shape=ellipse, color=green];
1564[label="217.53.140.241s;117pkt 117fpkt", shape=triangle, color=blue];
stat371[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.53.140.241:1044, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1044: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
593--1156[label="1;220pkt 220fpkt"];
593--1564[label="1;117pkt 117fpkt"];
1156--1564[label="1;117pkt 117fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.53.140.241" src_port="1044"/>
    </slice>
    <from sec="1041398126" usec="0"/>
    <to sec="1041398159" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_372{
style=filled;
color=gray75;
597[label="61.98.221.245s;247pkt 247fpkt", shape=rectangle, color=red];
1157[label="61.98.221.245s;247pkt 247fpkt", shape=ellipse, color=green];
1565[label="61.98.221.245s;93pkt 93fpkt", shape=triangle, color=blue];
stat372[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.98.221.245:21074, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21074: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
597--1157[label="1;247pkt 247fpkt"];
597--1565[label="1;93pkt 93fpkt"];
1157--1565[label="1;93pkt 93fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.98.221.245" src_port="21074"/>
    </slice>
    <from sec="1041397712" usec="0"/>
    <to sec="1041397752" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_373{
style=filled;
color=gray75;
598[label="91.85.236.245s;115pkt 115fpkt", shape=rectangle, color=red];
1158[label="91.85.236.245s;115pkt 115fpkt", shape=ellipse, color=green];
1566[label="91.85.236.245s;115pkt 115fpkt", shape=triangle, color=blue];
stat373[shape=component, label=&lt;Rules:&lt;BR/&gt;{91.85.236.245:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
598--1158[label="1;115pkt 115fpkt"];
598--1566[label="1;115pkt 115fpkt"];
1158--1566[label="1;115pkt 115fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="91.85.236.245" src_port="1027"/>
    </slice>
    <from sec="1041397918" usec="0"/>
    <to sec="1041397935" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03392,1.87602,002,1 1 1 0 0 0 0 0 0 1 0 1 ">
    <description>subgraph cluster_374{
style=filled;
color=gray75;
600[label="195.196.177.248s;84pkt 84fpkt", shape=rectangle, color=red];
1159[label="195.196.177.248s;84pkt 84fpkt", shape=ellipse, color=green];
1567[label="195.196.177.248s;84pkt 84fpkt", shape=triangle, color=blue];
4376[label="195.196.177.248;174pkt 174fpkt", shape=pentagon, color=darkviolet];
5285[label="195.196.177.248;155pkt 155fpkt", shape=invhouse, color=bisque];
stat374[shape=component, label=&lt;Rules:&lt;BR/&gt;{195.196.177.248:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
600--1159[label="1;84pkt 84fpkt"];
600--1567[label="1;84pkt 84fpkt"];
600--4376[label="1;84pkt 84fpkt"];
600--5285[label="1;84pkt 84fpkt"];
1159--1567[label="1;84pkt 84fpkt"];
1159--4376[label="1;84pkt 84fpkt"];
1159--5285[label="1;84pkt 84fpkt"];
1567--4376[label="1;84pkt 84fpkt"];
1567--5285[label="1;84pkt 84fpkt"];
4376--5285[label="1;155pkt 155fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="195.196.177.248" src_port="1026"/>
    </slice>
    <from sec="1041397844" usec="0"/>
    <to sec="1041397877" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.649115,1.85851,002,1 1 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_375{
style=filled;
color=gray75;
601[label="89.96.109.249s;168pkt 168fpkt", shape=rectangle, color=red];
1160[label="89.96.109.249s;168pkt 168fpkt", shape=ellipse, color=green];
4380[label="89.96.109.249;168pkt 168fpkt", shape=pentagon, color=darkviolet];
stat375[shape=component, label=&lt;Rules:&lt;BR/&gt;{89.96.109.249:61280, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 61280: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
601--1160[label="1;168pkt 168fpkt"];
601--4380[label="1;168pkt 168fpkt"];
1160--4380[label="1;168pkt 168fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="89.96.109.249" src_port="61280"/>
    </slice>
    <from sec="1041398028" usec="0"/>
    <to sec="1041398058" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_376{
style=filled;
color=gray75;
602[label="200.149.34.250s;147pkt 147fpkt", shape=rectangle, color=red];
1161[label="200.149.34.250s;139pkt 139fpkt", shape=ellipse, color=green];
1569[label="200.149.34.250s;139pkt 139fpkt", shape=triangle, color=blue];
4383[label="200.149.34.250;146pkt 146fpkt", shape=pentagon, color=darkviolet];
4982[label="200.149.34.250;146pkt 146fpkt", shape=invtriangle, color=brown];
stat376[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.149.34.250:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
602--1161[label="1;139pkt 139fpkt"];
602--1569[label="1;139pkt 139fpkt"];
602--4383[label="1;146pkt 146fpkt"];
602--4982[label="1;146pkt 146fpkt"];
1161--1569[label="1;139pkt 139fpkt"];
1161--4383[label="1;139pkt 139fpkt"];
1161--4982[label="1;139pkt 139fpkt"];
1569--4383[label="1;139pkt 139fpkt"];
1569--4982[label="1;139pkt 139fpkt"];
4383--4982[label="1;146pkt 146fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="200.149.34.250" src_port="1026"/>
    </slice>
    <from sec="1041397402" usec="0"/>
    <to sec="1041397431" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_377{
style=filled;
color=gray75;
603[label="4.151.181.250s;98pkt 98fpkt", shape=rectangle, color=red];
1162[label="4.151.181.250s;98pkt 98fpkt", shape=ellipse, color=green];
stat377[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.151.181.250:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
603--1162[label="1;98pkt 98fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="4.151.181.250" src_port="1027"/>
    </slice>
    <from sec="1041398584" usec="0"/>
    <to sec="1041398599" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.770694,1.8419,002,1 1 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_378{
style=filled;
color=gray75;
605[label="209.49.6.251s;139pkt 139fpkt", shape=rectangle, color=red];
1163[label="209.49.6.251s;121pkt 121fpkt", shape=ellipse, color=green];
4387[label="209.49.6.251;138pkt 138fpkt", shape=pentagon, color=darkviolet];
4983[label="209.49.6.251;137pkt 137fpkt", shape=invtriangle, color=brown];
stat378[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.49.6.251:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
605--1163[label="1;121pkt 121fpkt"];
605--4387[label="1;138pkt 138fpkt"];
605--4983[label="1;137pkt 137fpkt"];
1163--4387[label="0.991736;120pkt 120fpkt"];
1163--4983[label="0.983471;119pkt 119fpkt"];
4387--4983[label="1;137pkt 137fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="209.49.6.251" src_port="1026"/>
    </slice>
    <from sec="1041397336" usec="0"/>
    <to sec="1041397363" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_379{
style=filled;
color=gray75;
611[label="61.138.225.1s;168pkt 168fpkt", shape=rectangle, color=red];
1166[label="61.138.225.1s;110pkt 110fpkt", shape=ellipse, color=green];
stat379[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.138.225.1:*, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 47165: (0.359712%)&lt;BR/&gt; 47164: (0.359712%)&lt;BR/&gt; 47163: (0.359712%)&lt;BR/&gt; 47162: (0.359712%)&gt;];
}
611--1166[label="1;110pkt 110fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.138.225.1"/>
    </slice>
    <from sec="1041398306" usec="0"/>
    <to sec="1041398333" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_380{
style=filled;
color=gray75;
613[label="88.16.73.33s;100pkt 100fpkt", shape=rectangle, color=red];
1168[label="88.16.73.33s;100pkt 100fpkt", shape=ellipse, color=green];
1572[label="88.16.73.33s;100pkt 100fpkt", shape=triangle, color=blue];
stat380[shape=component, label=&lt;Rules:&lt;BR/&gt;{88.16.73.33:*, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 34493: (0.5%)&lt;BR/&gt; 34481: (0.5%)&lt;BR/&gt; 34469: (0.5%)&lt;BR/&gt; 34459: (0.5%)&gt;];
}
613--1168[label="1;100pkt 100fpkt"];
613--1572[label="1;100pkt 100fpkt"];
1168--1572[label="1;100pkt 100fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="88.16.73.33"/>
    </slice>
    <from sec="1041398298" usec="0"/>
    <to sec="1041398315" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.620401,1.94046,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="198.142.123.47" dst_port="137" proto="udp" src_ip="90.8.225.34"/>
      <filter dst_ip="198.142.123.47" dst_port="137" proto="icmp" src_ip="90.8.225.34"/>
      <from sec="1041398789" usec="0"/>
      <to sec="1041398799" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="198.142.123.47" dst_port="137" proto="udp" src_ip="144.52.225.34"/>
      <filter dst_ip="198.142.123.47" dst_port="137" proto="icmp" src_ip="144.52.225.34"/>
      <from sec="1041398785" usec="0"/>
      <to sec="1041398799" usec="0"/>
    </slice>
    <from sec="1041398785" usec="0"/>
    <to sec="1041398799" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_382{
style=filled;
color=gray75;
616[label="70.132.40.40s;36pkt 36fpkt", shape=rectangle, color=red];
1171[label="70.132.40.40s;36pkt 36fpkt", shape=ellipse, color=green];
1574[label="70.132.40.40s;36pkt 36fpkt", shape=triangle, color=blue];
stat382[shape=component, label=&lt;Rules:&lt;BR/&gt;{70.132.40.40:22965, *:137}[72.2222%]&lt;BR/&gt;{70.132.40.40:22978, *:137}[27.7778%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 22965: (36.1111%)&lt;BR/&gt; 22978: (13.8889%)&gt;];
}
616--1171[label="1;36pkt 36fpkt"];
616--1574[label="1;36pkt 36fpkt"];
1171--1574[label="1;36pkt 36fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="70.132.40.40" src_port="22965"/>
      <filter dst_port="137" src_ip="70.132.40.40" src_port="22978"/>
    </slice>
    <from sec="1041397547" usec="0"/>
    <to sec="1041397561" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_383{
style=filled;
color=gray75;
617[label="218.164.65.46s;77pkt 77fpkt", shape=rectangle, color=red];
1172[label="218.164.65.46s;77pkt 77fpkt", shape=ellipse, color=green];
1575[label="218.164.65.46s;77pkt 77fpkt", shape=triangle, color=blue];
3550[label="218.164.65.46;101pkt 101fpkt", shape=pentagon, color=darkviolet];
4531[label="218.164.65.46;101pkt 101fpkt", shape=invtriangle, color=brown];
stat383[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.164.65.46:*, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 62084: (0.577367%)&lt;BR/&gt; 62069: (0.577367%)&lt;BR/&gt; 62057: (0.577367%)&lt;BR/&gt; 62041: (0.577367%)&gt;];
}
617--1172[label="1;77pkt 77fpkt"];
617--1575[label="1;77pkt 77fpkt"];
617--3550[label="1;77pkt 77fpkt"];
617--4531[label="1;77pkt 77fpkt"];
1172--1575[label="1;77pkt 77fpkt"];
1172--3550[label="1;77pkt 77fpkt"];
1172--4531[label="1;77pkt 77fpkt"];
1575--3550[label="1;77pkt 77fpkt"];
1575--4531[label="1;77pkt 77fpkt"];
3550--4531[label="1;101pkt 101fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="218.164.65.46"/>
    </slice>
    <from sec="1041398261" usec="0"/>
    <to sec="1041398277" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_384{
style=filled;
color=gray75;
618[label="217.32.36.62s;100pkt 100fpkt", shape=rectangle, color=red];
1173[label="217.32.36.62s;100pkt 100fpkt", shape=ellipse, color=green];
1576[label="217.32.36.62s;100pkt 100fpkt", shape=triangle, color=blue];
3606[label="217.32.36.62;146pkt 146fpkt", shape=pentagon, color=darkviolet];
4564[label="217.32.36.62;145pkt 145fpkt", shape=invtriangle, color=brown];
5074[label="217.32.36.62;145pkt 145fpkt", shape=invhouse, color=bisque];
stat384[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.32.36.62:*, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 34775: (0.407609%)&lt;BR/&gt; 34772: (0.407609%)&lt;BR/&gt; 34771: (0.407609%)&lt;BR/&gt; 34758: (0.407609%)&gt;];
}
618--1173[label="1;100pkt 100fpkt"];
618--1576[label="1;100pkt 100fpkt"];
618--3606[label="1;100pkt 100fpkt"];
618--4564[label="1;100pkt 100fpkt"];
618--5074[label="1;100pkt 100fpkt"];
1173--1576[label="1;100pkt 100fpkt"];
1173--3606[label="1;100pkt 100fpkt"];
1173--4564[label="1;100pkt 100fpkt"];
1173--5074[label="1;100pkt 100fpkt"];
1576--3606[label="1;100pkt 100fpkt"];
1576--4564[label="1;100pkt 100fpkt"];
1576--5074[label="1;100pkt 100fpkt"];
3606--4564[label="1;145pkt 145fpkt"];
3606--5074[label="1;145pkt 145fpkt"];
4564--5074[label="1;145pkt 145fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.32.36.62"/>
    </slice>
    <from sec="1041397554" usec="0"/>
    <to sec="1041397577" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_385{
style=filled;
color=gray75;
619[label="89.73.229.63s;103pkt 103fpkt", shape=rectangle, color=red];
1174[label="89.73.229.63s;103pkt 103fpkt", shape=ellipse, color=green];
1577[label="89.73.229.63s;103pkt 103fpkt", shape=triangle, color=blue];
3612[label="89.73.229.63;126pkt 126fpkt", shape=pentagon, color=darkviolet];
stat385[shape=component, label=&lt;Rules:&lt;BR/&gt;{89.73.229.63:*, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 57932: (0.45977%)&lt;BR/&gt; 57928: (0.45977%)&lt;BR/&gt; 57926: (0.45977%)&lt;BR/&gt; 57922: (0.45977%)&gt;];
}
619--1174[label="1;103pkt 103fpkt"];
619--1577[label="1;103pkt 103fpkt"];
619--3612[label="0.990291;102pkt 102fpkt"];
1174--1577[label="1;103pkt 103fpkt"];
1174--3612[label="0.990291;102pkt 102fpkt"];
1577--3612[label="0.990291;102pkt 102fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="89.73.229.63"/>
    </slice>
    <from sec="1041398405" usec="0"/>
    <to sec="1041398426" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_386{
style=filled;
color=gray75;
620[label="203.104.40.78s;113pkt 113fpkt", shape=rectangle, color=red];
1175[label="203.104.40.78s;113pkt 113fpkt", shape=ellipse, color=green];
stat386[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.104.40.78:*, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 4993: (0.442478%)&lt;BR/&gt; 4986: (0.442478%)&lt;BR/&gt; 4975: (0.442478%)&lt;BR/&gt; 4966: (0.442478%)&gt;];
}
620--1175[label="1;113pkt 113fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="203.104.40.78"/>
    </slice>
    <from sec="1041397620" usec="0"/>
    <to sec="1041397636" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.946667,1.87498,010,1 1 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_387{
style=filled;
color=gray75;
32[label="89.80.44.81s;8276pkt 8276fpkt", shape=rectangle, color=red];
1176[label="89.80.44.81s;8276pkt 8276fpkt", shape=ellipse, color=green];
1578[label="89.80.44.81s;8276pkt 8276fpkt", shape=triangle, color=blue];
1683[label="89.80.44.81;s;7866pkt 7866fpkt", shape=diamond, color=yellow];
stat387[shape=component, label=&lt;Rules:&lt;BR/&gt;{89.80.44.81:*, *:3389}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3389: (50.0122%)&lt;BR/&gt; 5000: (0.0168227%)&lt;BR/&gt; 4999: (0.0168227%)&lt;BR/&gt; 4998: (0.0168227%)&lt;BR/&gt; 4997: (0.0168227%)&gt;];
}
32--1176[label="1;8276pkt 8276fpkt"];
32--1578[label="1;8276pkt 8276fpkt"];
32--1683[label="1;7866pkt 7866fpkt"];
1176--1578[label="1;8276pkt 8276fpkt"];
1176--1683[label="1;7866pkt 7866fpkt"];
1578--1683[label="1;7866pkt 7866fpkt"];
</description>
    <slice>
      <filter dst_port="3389" src_ip="89.80.44.81"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398819" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_388{
style=filled;
color=gray75;
628[label="202.87.12.166s;62pkt 62fpkt", shape=rectangle, color=red];
1182[label="202.87.12.166s;62pkt 62fpkt", shape=ellipse, color=green];
stat388[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.87.12.166:*, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 37212: (0.806452%)&lt;BR/&gt; 37177: (0.806452%)&lt;BR/&gt; 37133: (0.806452%)&lt;BR/&gt; 37102: (0.806452%)&gt;];
}
628--1182[label="1;62pkt 62fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="202.87.12.166"/>
    </slice>
    <from sec="1041397297" usec="0"/>
    <to sec="1041397308" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_389{
style=filled;
color=gray75;
629[label="61.242.73.168s;141pkt 141fpkt", shape=rectangle, color=red];
1183[label="61.242.73.168s;107pkt 107fpkt", shape=ellipse, color=green];
stat389[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.242.73.168:*, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 65092: (0.403226%)&lt;BR/&gt; 65088: (0.403226%)&lt;BR/&gt; 65084: (0.403226%)&lt;BR/&gt; 65081: (0.403226%)&gt;];
}
629--1183[label="1;107pkt 107fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.242.73.168"/>
    </slice>
    <from sec="1041398585" usec="0"/>
    <to sec="1041398610" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_390{
style=filled;
color=gray75;
631[label="217.61.247.178s;175pkt 175fpkt", shape=rectangle, color=red];
1184[label="217.61.247.178s;84pkt 84fpkt", shape=ellipse, color=green];
stat390[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.61.247.178:*, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 50608: (0.579151%)&lt;BR/&gt; 50601: (0.579151%)&lt;BR/&gt; 50639: (0.3861%)&lt;BR/&gt; 50633: (0.3861%)&gt;];
}
631--1184[label="1;84pkt 84fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.61.247.178"/>
    </slice>
    <from sec="1041397468" usec="0"/>
    <to sec="1041397499" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_391{
style=filled;
color=gray75;
632[label="70.73.16.190s;92pkt 92fpkt", shape=rectangle, color=red];
1185[label="70.73.16.190s;92pkt 92fpkt", shape=ellipse, color=green];
1584[label="70.73.16.190s;92pkt 92fpkt", shape=triangle, color=blue];
stat391[shape=component, label=&lt;Rules:&lt;BR/&gt;{70.73.16.190:*, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 50274: (0.543478%)&lt;BR/&gt; 50273: (0.543478%)&lt;BR/&gt; 50268: (0.543478%)&lt;BR/&gt; 50267: (0.543478%)&gt;];
}
632--1185[label="1;92pkt 92fpkt"];
632--1584[label="1;92pkt 92fpkt"];
1185--1584[label="1;92pkt 92fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="70.73.16.190"/>
    </slice>
    <from sec="1041398782" usec="0"/>
    <to sec="1041398797" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_392{
style=filled;
color=gray75;
634[label="210.82.201.196s;241pkt 241fpkt", shape=rectangle, color=red];
1187[label="210.82.201.196s;207pkt 207fpkt", shape=ellipse, color=green];
1586[label="210.82.201.196s;207pkt 207fpkt", shape=triangle, color=blue];
stat392[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.82.201.196:*, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 37032: (0.229008%)&lt;BR/&gt; 37031: (0.229008%)&lt;BR/&gt; 37030: (0.229008%)&lt;BR/&gt; 37029: (0.229008%)&gt;];
}
634--1187[label="1;207pkt 207fpkt"];
634--1586[label="1;207pkt 207fpkt"];
1187--1586[label="1;207pkt 207fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="210.82.201.196"/>
    </slice>
    <from sec="1041397655" usec="0"/>
    <to sec="1041397695" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_393{
style=filled;
color=gray75;
636[label="212.40.190.212s;191pkt 191fpkt", shape=rectangle, color=red];
1188[label="212.40.190.212s;191pkt 191fpkt", shape=ellipse, color=green];
1587[label="212.40.190.212s;191pkt 191fpkt", shape=triangle, color=blue];
stat393[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.40.190.212:*, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 35267: (0.26178%)&lt;BR/&gt; 35266: (0.26178%)&lt;BR/&gt; 35265: (0.26178%)&lt;BR/&gt; 35264: (0.26178%)&gt;];
}
636--1188[label="1;191pkt 191fpkt"];
636--1587[label="1;191pkt 191fpkt"];
1188--1587[label="1;191pkt 191fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="212.40.190.212"/>
    </slice>
    <from sec="1041397373" usec="0"/>
    <to sec="1041397401" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,999,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_394{
style=filled;
color=gray75;
638[label="4.130.118.229s;1pkt 1fpkt", shape=rectangle, color=red];
1189[label="4.130.118.229s;1pkt 1fpkt", shape=ellipse, color=green];
stat394[shape=component, label=&lt;Rules:&lt;BR/&gt;{213.127.46.229:3189, 203.59.21.3:53}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3189: (50%)&lt;BR/&gt; 53: (50%)&gt;];
}
638--1189[label="1;1pkt 1fpkt"];
638--1638[label="1;1pkt 1fpkt"];
1189--1638[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="203.59.21.3" dst_port="53" src_ip="213.127.46.229" src_port="3189"/>
    </slice>
    <from sec="1041397642" usec="0"/>
    <to sec="1041397654" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_395{
style=filled;
color=gray75;
639[label="219.196.44.240s;139pkt 139fpkt", shape=rectangle, color=red];
1190[label="219.196.44.240s;100pkt 100fpkt", shape=ellipse, color=green];
stat395[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.196.44.240:*, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 35246: (0.41841%)&lt;BR/&gt; 35245: (0.41841%)&lt;BR/&gt; 35236: (0.41841%)&lt;BR/&gt; 35225: (0.41841%)&gt;];
}
639--1190[label="1;100pkt 100fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="219.196.44.240"/>
    </slice>
    <from sec="1041397842" usec="0"/>
    <to sec="1041397869" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_396{
style=filled;
color=gray75;
642[label="217.51.62.250s;188pkt 188fpkt", shape=rectangle, color=red];
1192[label="217.51.62.250s;99pkt 99fpkt", shape=ellipse, color=green];
stat396[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.51.62.250:*, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 65534: (0.348432%)&lt;BR/&gt; 65514: (0.348432%)&lt;BR/&gt; 65503: (0.348432%)&lt;BR/&gt; 65484: (0.348432%)&gt;];
}
642--1192[label="1;99pkt 99fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.51.62.250"/>
    </slice>
    <from sec="1041398681" usec="0"/>
    <to sec="1041398712" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,020,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_397{
style=filled;
color=gray75;
645[label="218.235.134.45d;178pkt 178fpkt", shape=rectangle, color=red];
1194[label="218.235.134.45d;97pkt 97fpkt", shape=ellipse, color=green];
1590[label="218.235.134.45d;97pkt 97fpkt", shape=triangle, color=blue];
stat397[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 218.235.134.45:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
645--1194[label="1;97pkt 97fpkt"];
645--1590[label="1;97pkt 97fpkt"];
1194--1590[label="1;97pkt 97fpkt"];
</description>
    <slice>
      <filter dst_ip="218.235.134.45"/>
    </slice>
    <from sec="1041397576" usec="0"/>
    <to sec="1041397604" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,503,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_399{
style=filled;
color=gray75;
647[label="89.73.229.63d;1pkt 1fpkt", shape=rectangle, color=red];
1196[label="89.73.229.63d;1pkt 1fpkt", shape=ellipse, color=green];
1592[label="89.73.229.63d;1pkt 1fpkt", shape=triangle, color=blue];
stat399[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.159.192.34:50665, 90.222.61.62:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 50665: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
647--1196[label="1;1pkt 1fpkt"];
647--1592[label="1;1pkt 1fpkt"];
647--3279[label="1;1pkt 1fpkt"];
647--3294[label="1;1pkt 1fpkt"];
1196--1592[label="1;1pkt 1fpkt"];
1196--3279[label="1;1pkt 1fpkt"];
1196--3294[label="1;1pkt 1fpkt"];
1592--3279[label="1;1pkt 1fpkt"];
1592--3294[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="90.222.61.62" dst_port="80" src_ip="202.159.192.34" src_port="50665"/>
    </slice>
    <from sec="1041398408" usec="0"/>
    <to sec="1041398423" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.09123,1.91892,503,1 1 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_400{
style=filled;
color=gray75;
648[label="202.37.177.64d;1pkt 1fpkt", shape=rectangle, color=red];
1197[label="202.37.177.64d;1pkt 1fpkt", shape=ellipse, color=green];
1750[label="136.234.78.215;s;1320pkt 1320fpkt", shape=diamond, color=yellow];
2769[label="192.163.103.115;d;1pkt 1fpkt", shape=hexagon, color=black];
stat400[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.78.215:*, *:80}[99.0909%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.5465%)&lt;BR/&gt; 1755: (0.340136%)&lt;BR/&gt; 3702: (0.113379%)&lt;BR/&gt; 3050: (0.0755858%)&lt;BR/&gt; 2804: (0.0755858%)&gt;];
}
648--1197[label="1;1pkt 1fpkt"];
648--1750[label="1;1pkt 1fpkt"];
1197--1750[label="1;1pkt 1fpkt"];
1750--1757[label="0.5;1pkt 1fpkt"];
1750--1879[label="1;76pkt 76fpkt"];
1750--1959[label="0.129032;8pkt 8fpkt"];
1750--2185[label="0.00497512;1pkt 1fpkt"];
1750--2208[label="0.0357143;3pkt 3fpkt"];
1750--2257[label="0.0333333;3pkt 3fpkt"];
1750--2273[label="0.00492611;1pkt 1fpkt"];
1750--2277[label="0.0264901;4pkt 4fpkt"];
1750--2339[label="0.00591716;1pkt 1fpkt"];
1750--2381[label="0.555556;145pkt 145fpkt"];
1750--2441[label="0.6;15pkt 15fpkt"];
1750--2460[label="0.0444444;4pkt 4fpkt"];
1750--2696[label="0.0142857;1pkt 1fpkt"];
1750--2708[label="1;14pkt 14fpkt"];
1750--2769[label="1;1pkt 1fpkt"];
1750--2828[label="1;76pkt 76fpkt"];
1750--3002[label="0.0361446;3pkt 3fpkt"];
1750--3022[label="0.00877193;1pkt 1fpkt"];
1750--3087[label="0.0153846;2pkt 2fpkt"];
1750--3092[label="0.278571;39pkt 39fpkt"];
1750--3097[label="0.764706;13pkt 13fpkt"];
1750--3275[label="0.00454545;6pkt 6fpkt"];
1750--3279[label="0.0719697;95pkt 95fpkt"];
1750--3283[label="0.10303;136pkt 136fpkt"];
1750--3284[label="0.0469697;62pkt 62fpkt"];
1750--3289[label="0.00454545;6pkt 6fpkt"];
1750--3294[label="0.0719697;95pkt 95fpkt"];
1750--3298[label="0.00454545;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="136.234.78.215"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,020,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_401{
style=filled;
color=gray75;
659[label="211.57.133.191d;119pkt 119fpkt", shape=rectangle, color=red];
1207[label="211.57.133.191d;119pkt 119fpkt", shape=ellipse, color=green];
stat401[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 211.57.133.191:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
659--1207[label="1;119pkt 119fpkt"];
</description>
    <slice>
      <filter dst_ip="211.57.133.191"/>
    </slice>
    <from sec="1041398467" usec="0"/>
    <to sec="1041398484" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,020,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_402{
style=filled;
color=gray75;
660[label="23.55.1.194d;87pkt 87fpkt", shape=rectangle, color=red];
1208[label="23.55.1.194d;87pkt 87fpkt", shape=ellipse, color=green];
stat402[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 23.55.1.194:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
660--1208[label="1;87pkt 87fpkt"];
</description>
    <slice>
      <filter dst_ip="23.55.1.194"/>
    </slice>
    <from sec="1041397844" usec="0"/>
    <to sec="1041397856" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,020,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_403{
style=filled;
color=gray75;
666[label="93.145.173.247d;183pkt 183fpkt", shape=rectangle, color=red];
1211[label="93.145.173.247d;183pkt 183fpkt", shape=ellipse, color=green];
1600[label="93.145.173.247d;125pkt 125fpkt", shape=triangle, color=blue];
stat403[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 93.145.173.247:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
666--1211[label="1;183pkt 183fpkt"];
666--1600[label="1;125pkt 125fpkt"];
1211--1600[label="1;125pkt 125fpkt"];
</description>
    <slice>
      <filter dst_ip="93.145.173.247"/>
    </slice>
    <from sec="1041398062" usec="0"/>
    <to sec="1041398090" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,503,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_404{
style=filled;
color=gray75;
667[label="195.196.177.248d;3pkt 3fpkt", shape=rectangle, color=red];
1212[label="195.196.177.248d;3pkt 3fpkt", shape=ellipse, color=green];
1601[label="195.196.177.248d;3pkt 3fpkt", shape=triangle, color=blue];
3849[label="148.155.61.116;12pkt 12fpkt", shape=pentagon, color=darkviolet];
4691[label="148.155.61.116;13pkt 13fpkt", shape=invtriangle, color=brown];
4695[label="148.155.61.118;14pkt 14fpkt", shape=invtriangle, color=brown];
5143[label="148.155.61.118;14pkt 14fpkt", shape=invhouse, color=bisque];
stat404[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.155.61.116:*, 218.211.249.12:80}[40.7407%]&lt;BR/&gt;{148.155.61.118:*, 218.211.249.12:80}[37.037%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (46.7742%)&lt;BR/&gt; 44493: (4.03226%)&lt;BR/&gt; 37954: (4.03226%)&lt;BR/&gt; 44492: (3.22581%)&lt;BR/&gt; 443: (3.22581%)&gt;];
}
667--1212[label="1;3pkt 3fpkt"];
667--1601[label="1;3pkt 3fpkt"];
667--3849[label="0.333333;1pkt 1fpkt"];
667--4691[label="0.666667;2pkt 2fpkt"];
667--4695[label="0.333333;1pkt 1fpkt"];
667--5143[label="0.333333;1pkt 1fpkt"];
1212--1601[label="1;3pkt 3fpkt"];
1212--3849[label="0.333333;1pkt 1fpkt"];
1212--4691[label="0.666667;2pkt 2fpkt"];
1212--4695[label="0.333333;1pkt 1fpkt"];
1212--5143[label="0.333333;1pkt 1fpkt"];
1601--3849[label="0.333333;1pkt 1fpkt"];
1601--4691[label="0.666667;2pkt 2fpkt"];
1601--4695[label="0.333333;1pkt 1fpkt"];
1601--5143[label="0.333333;1pkt 1fpkt"];
3849--4691[label="1;12pkt 12fpkt"];
4695--5143[label="1;14pkt 14fpkt"];
</description>
    <slice>
      <filter dst_ip="218.211.249.12" dst_port="80" src_ip="148.155.61.118"/>
      <filter dst_ip="218.211.249.12" dst_port="80" src_ip="148.155.61.116"/>
    </slice>
    <from sec="1041397751" usec="0"/>
    <to sec="1041397970" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,503,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_405{
style=filled;
color=gray75;
668[label="4.235.168.250d;1pkt 1fpkt", shape=rectangle, color=red];
1213[label="4.235.168.250d;1pkt 1fpkt", shape=ellipse, color=green];
1602[label="4.235.168.250d;1pkt 1fpkt", shape=triangle, color=blue];
stat405[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.159.192.34:40124, 88.177.12.249:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 40124: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
668--1213[label="1;1pkt 1fpkt"];
668--1602[label="1;1pkt 1fpkt"];
668--1780[label="1;1pkt 1fpkt"];
1213--1602[label="1;1pkt 1fpkt"];
1213--1780[label="1;1pkt 1fpkt"];
1602--1780[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="88.177.12.249" dst_port="80" src_ip="202.159.192.34" src_port="40124"/>
    </slice>
    <from sec="1041397499" usec="0"/>
    <to sec="1041397532" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,020,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_406{
style=filled;
color=gray75;
669[label="216.241.42.254d;71pkt 71fpkt", shape=rectangle, color=red];
1214[label="216.241.42.254d;71pkt 71fpkt", shape=ellipse, color=green];
stat406[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 216.241.42.254:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
669--1214[label="1;71pkt 71fpkt"];
</description>
    <slice>
      <filter dst_ip="216.241.42.254"/>
    </slice>
    <from sec="1041398483" usec="0"/>
    <to sec="1041398497" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,020,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_407{
style=filled;
color=gray75;
671[label="206.81.9.8d;56pkt 56fpkt", shape=rectangle, color=red];
1215[label="206.81.9.8d;56pkt 56fpkt", shape=ellipse, color=green];
stat407[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 206.81.9.8:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
671--1215[label="1;56pkt 56fpkt"];
</description>
    <slice>
      <filter dst_ip="206.81.9.8"/>
    </slice>
    <from sec="1041398089" usec="0"/>
    <to sec="1041398110" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,020,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_408{
style=filled;
color=gray75;
672[label="156.176.146.228d;78pkt 78fpkt", shape=rectangle, color=red];
1216[label="156.176.146.228d;78pkt 78fpkt", shape=ellipse, color=green];
stat408[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 156.176.146.228:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
672--1216[label="1;78pkt 78fpkt"];
</description>
    <slice>
      <filter dst_ip="156.176.146.228"/>
    </slice>
    <from sec="1041397444" usec="0"/>
    <to sec="1041397457" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,020,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_409{
style=filled;
color=gray75;
676[label="88.143.241.46d;56pkt 56fpkt", shape=rectangle, color=red];
1219[label="88.143.241.46d;56pkt 56fpkt", shape=ellipse, color=green];
stat409[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 88.143.241.46:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
676--1219[label="1;56pkt 56fpkt"];
</description>
    <slice>
      <filter dst_ip="88.143.241.46"/>
    </slice>
    <from sec="1041397201" usec="0"/>
    <to sec="1041397217" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,503,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_410{
style=filled;
color=gray75;
677[label="70.44.164.62d;5pkt 5fpkt", shape=rectangle, color=red];
1220[label="70.44.164.62d;5pkt 5fpkt", shape=ellipse, color=green];
1591[label="70.44.164.62d;2pkt 2fpkt", shape=triangle, color=blue];
stat410[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.159.192.25:1754, 209.205.16.61:80}[20%]&lt;BR/&gt;{202.159.192.25:1804, 209.205.16.61:80}[20%]&lt;BR/&gt;{202.159.192.25:1903, 209.205.16.61:80}[20%]&lt;BR/&gt;{202.159.192.25:2036, 209.205.16.61:80}[20%]&lt;BR/&gt;{202.159.192.25:2090, 209.205.16.61:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2090: (12.5%)&lt;BR/&gt; 2036: (12.5%)&lt;BR/&gt; 1903: (8.33333%)&lt;BR/&gt; 1804: (8.33333%)&gt;];
}
677--1220[label="1;5pkt 5fpkt"];
677--1591[label="1;2pkt 2fpkt"];
677--1656[label="1;5pkt 5fpkt"];
677--2797[label="1;5pkt 5fpkt"];
1220--1591[label="1;2pkt 2fpkt"];
1220--1656[label="1;5pkt 5fpkt"];
1220--2797[label="1;5pkt 5fpkt"];
1591--1656[label="1;2pkt 2fpkt"];
1591--2797[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="209.205.16.61" dst_port="80" src_ip="202.159.192.25" src_port="2090"/>
      <filter dst_ip="209.205.16.61" dst_port="80" src_ip="202.159.192.25" src_port="2036"/>
      <filter dst_ip="209.205.16.61" dst_port="80" src_ip="202.159.192.25" src_port="1903"/>
      <filter dst_ip="209.205.16.61" dst_port="80" src_ip="202.159.192.25" src_port="1804"/>
      <filter dst_ip="209.205.16.61" dst_port="80" src_ip="202.159.192.25" src_port="1754"/>
    </slice>
    <from sec="1041397671" usec="0"/>
    <to sec="1041397705" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,020,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_411{
style=filled;
color=gray75;
678[label="91.185.39.79d;75pkt 75fpkt", shape=rectangle, color=red];
1221[label="91.185.39.79d;75pkt 75fpkt", shape=ellipse, color=green];
1604[label="91.185.39.79d;76pkt 76fpkt", shape=triangle, color=blue];
stat411[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 91.185.39.79:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
678--1221[label="1;75pkt 75fpkt"];
678--1604[label="1;75pkt 75fpkt"];
1221--1604[label="1;75pkt 75fpkt"];
</description>
    <slice>
      <filter dst_ip="91.185.39.79"/>
    </slice>
    <from sec="1041397753" usec="0"/>
    <to sec="1041397769" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,020,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_412{
style=filled;
color=gray75;
679[label="137.72.26.89d;188pkt 188fpkt", shape=rectangle, color=red];
1222[label="137.72.26.89d;188pkt 188fpkt", shape=ellipse, color=green];
1605[label="137.72.26.89d;188pkt 188fpkt", shape=triangle, color=blue];
stat412[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 137.72.26.89:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
679--1222[label="1;188pkt 188fpkt"];
679--1605[label="1;188pkt 188fpkt"];
1222--1605[label="1;188pkt 188fpkt"];
</description>
    <slice>
      <filter dst_ip="137.72.26.89"/>
    </slice>
    <from sec="1041398409" usec="0"/>
    <to sec="1041398437" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,020,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_413{
style=filled;
color=gray75;
680[label="91.26.193.100d;185pkt 185fpkt", shape=rectangle, color=red];
1223[label="91.26.193.100d;185pkt 185fpkt", shape=ellipse, color=green];
stat413[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 91.26.193.100:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
680--1223[label="1;185pkt 185fpkt"];
</description>
    <slice>
      <filter dst_ip="91.26.193.100"/>
    </slice>
    <from sec="1041397813" usec="0"/>
    <to sec="1041397842" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,020,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_414{
style=filled;
color=gray75;
684[label="219.196.44.240d;139pkt 139fpkt", shape=rectangle, color=red];
1224[label="219.196.44.240d;100pkt 100fpkt", shape=ellipse, color=green];
stat414[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 219.196.44.240:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
684--1224[label="1;100pkt 100fpkt"];
</description>
    <slice>
      <filter dst_ip="219.196.44.240"/>
    </slice>
    <from sec="1041397842" usec="0"/>
    <to sec="1041397863" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,020,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_415{
style=filled;
color=gray75;
685[label="203.23.81.243d;407pkt 407fpkt", shape=rectangle, color=red];
1225[label="203.23.81.243d;407pkt 407fpkt", shape=ellipse, color=green];
1606[label="203.23.81.243d;407pkt 407fpkt", shape=triangle, color=blue];
stat415[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 203.23.81.243:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
685--1225[label="1;407pkt 407fpkt"];
685--1606[label="1;407pkt 407fpkt"];
1225--1606[label="1;407pkt 407fpkt"];
</description>
    <slice>
      <filter dst_ip="203.23.81.243"/>
    </slice>
    <from sec="1041397483" usec="0"/>
    <to sec="1041398220" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,020,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_416{
style=filled;
color=gray75;
686[label="211.67.144.246d;53pkt 53fpkt", shape=rectangle, color=red];
1226[label="211.67.144.246d;53pkt 53fpkt", shape=ellipse, color=green];
stat416[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 211.67.144.246:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
686--1226[label="1;53pkt 53fpkt"];
</description>
    <slice>
      <filter dst_ip="211.67.144.246"/>
    </slice>
    <from sec="1041398666" usec="0"/>
    <to sec="1041398681" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,020,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_417{
style=filled;
color=gray75;
689[label="200.78.129.55d;81pkt 81fpkt", shape=rectangle, color=red];
1227[label="200.78.129.55d;81pkt 81fpkt", shape=ellipse, color=green];
stat417[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 200.78.129.55:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
689--1227[label="1;81pkt 81fpkt"];
</description>
    <slice>
      <filter dst_ip="200.78.129.55"/>
    </slice>
    <from sec="1041398249" usec="0"/>
    <to sec="1041398266" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,020,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_418{
style=filled;
color=gray75;
690[label="88.67.179.69d;211pkt 211fpkt", shape=rectangle, color=red];
1228[label="88.67.179.69d;91pkt 91fpkt", shape=ellipse, color=green];
1608[label="88.67.179.69d;91pkt 91fpkt", shape=triangle, color=blue];
stat418[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 88.67.179.69:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
690--1228[label="1;91pkt 91fpkt"];
690--1608[label="1;91pkt 91fpkt"];
1228--1608[label="1;91pkt 91fpkt"];
</description>
    <slice>
      <filter dst_ip="88.67.179.69"/>
    </slice>
    <from sec="1041398034" usec="0"/>
    <to sec="1041398073" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,020,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_419{
style=filled;
color=gray75;
691[label="89.209.23.104d;253pkt 253fpkt", shape=rectangle, color=red];
1229[label="89.209.23.104d;253pkt 253fpkt", shape=ellipse, color=green];
1609[label="89.209.23.104d;253pkt 253fpkt", shape=triangle, color=blue];
stat419[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 89.209.23.104:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
691--1229[label="1;253pkt 253fpkt"];
691--1609[label="1;253pkt 253fpkt"];
1229--1609[label="1;253pkt 253fpkt"];
</description>
    <slice>
      <filter dst_ip="89.209.23.104"/>
    </slice>
    <from sec="1041397395" usec="0"/>
    <to sec="1041397409" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,020,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_420{
style=filled;
color=gray75;
692[label="218.201.85.105d;136pkt 136fpkt", shape=rectangle, color=red];
1230[label="218.201.85.105d;136pkt 136fpkt", shape=ellipse, color=green];
stat420[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 218.201.85.105:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
692--1230[label="1;136pkt 136fpkt"];
</description>
    <slice>
      <filter dst_ip="218.201.85.105"/>
    </slice>
    <from sec="1041397817" usec="0"/>
    <to sec="1041397843" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,020,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_421{
style=filled;
color=gray75;
682[label="170.235.93.111d;150pkt 150fpkt", shape=rectangle, color=red];
1231[label="170.235.93.111d;118pkt 118fpkt", shape=ellipse, color=green];
1610[label="170.235.93.111d;118pkt 118fpkt", shape=triangle, color=blue];
stat421[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 170.235.93.111:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
682--1231[label="1;118pkt 118fpkt"];
682--1610[label="1;118pkt 118fpkt"];
1231--1610[label="1;118pkt 118fpkt"];
</description>
    <slice>
      <filter dst_ip="170.235.93.111"/>
    </slice>
    <from sec="1041398483" usec="0"/>
    <to sec="1041398514" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,020,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_422{
style=filled;
color=gray75;
696[label="202.233.180.165d;211pkt 211fpkt", shape=rectangle, color=red];
1232[label="202.233.180.165d;211pkt 211fpkt", shape=ellipse, color=green];
1611[label="202.233.180.165d;211pkt 211fpkt", shape=triangle, color=blue];
stat422[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 202.233.180.165:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
696--1232[label="1;211pkt 211fpkt"];
696--1611[label="1;211pkt 211fpkt"];
1232--1611[label="1;211pkt 211fpkt"];
</description>
    <slice>
      <filter dst_ip="202.233.180.165"/>
    </slice>
    <from sec="1041397444" usec="0"/>
    <to sec="1041397483" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,020,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_423{
style=filled;
color=gray75;
697[label="89.213.179.175d;65pkt 65fpkt", shape=rectangle, color=red];
1233[label="89.213.179.175d;65pkt 65fpkt", shape=ellipse, color=green];
stat423[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 89.213.179.175:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
697--1233[label="1;65pkt 65fpkt"];
</description>
    <slice>
      <filter dst_ip="89.213.179.175"/>
    </slice>
    <from sec="1041398143" usec="0"/>
    <to sec="1041398159" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636054,1.89927,020,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_424{
style=filled;
color=gray75;
698[label="205.1.174.198d;113pkt 113fpkt", shape=rectangle, color=red];
1234[label="205.1.174.198d;113pkt 113fpkt", shape=ellipse, color=green];
stat424[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 205.1.174.198:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
698--1234[label="1;113pkt 113fpkt"];
</description>
    <slice>
      <filter dst_ip="205.1.174.198"/>
    </slice>
    <from sec="1041398234" usec="0"/>
    <to sec="1041398250" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,020,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_425{
style=filled;
color=gray75;
699[label="219.27.37.208d;133pkt 133fpkt", shape=rectangle, color=red];
1235[label="219.27.37.208d;133pkt 133fpkt", shape=ellipse, color=green];
1613[label="219.27.37.208d;72pkt 72fpkt", shape=triangle, color=blue];
stat425[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 219.27.37.208:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
699--1235[label="1;133pkt 133fpkt"];
699--1613[label="1;72pkt 72fpkt"];
1235--1613[label="1;72pkt 72fpkt"];
</description>
    <slice>
      <filter dst_ip="219.27.37.208"/>
    </slice>
    <from sec="1041397788" usec="0"/>
    <to sec="1041397812" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,020,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_426{
style=filled;
color=gray75;
700[label="62.81.11.212d;196pkt 196fpkt", shape=rectangle, color=red];
1236[label="62.81.11.212d;154pkt 154fpkt", shape=ellipse, color=green];
1614[label="62.81.11.212d;70pkt 70fpkt", shape=triangle, color=blue];
stat426[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 62.81.11.212:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
700--1236[label="1;154pkt 154fpkt"];
700--1614[label="1;70pkt 70fpkt"];
1236--1614[label="1;70pkt 70fpkt"];
</description>
    <slice>
      <filter dst_ip="62.81.11.212"/>
    </slice>
    <from sec="1041398365" usec="0"/>
    <to sec="1041398407" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,020,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_427{
style=filled;
color=gray75;
662[label="175.8.107.214d;114pkt 114fpkt", shape=rectangle, color=red];
1237[label="175.8.107.214d;80pkt 80fpkt", shape=ellipse, color=green];
1615[label="175.8.107.214d;80pkt 80fpkt", shape=triangle, color=blue];
stat427[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 175.8.107.214:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
662--1237[label="1;80pkt 80fpkt"];
662--1615[label="1;80pkt 80fpkt"];
1237--1615[label="1;80pkt 80fpkt"];
</description>
    <slice>
      <filter dst_ip="175.8.107.214"/>
    </slice>
    <from sec="1041397897" usec="0"/>
    <to sec="1041397916" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695213,1.95262,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="197.90.54.66" dst_port="137" proto="tcp" src_ip="61.226.36.138" src_port="1026"/>
      <filter dst_ip="197.90.54.66" dst_port="137" proto="udp" src_ip="61.226.36.138" src_port="1026"/>
      <filter dst_ip="197.90.54.66" dst_port="80" proto="tcp" src_ip="61.226.36.138" src_port="1026"/>
      <filter dst_ip="197.90.54.66" dst_port="80" proto="udp" src_ip="61.226.36.138" src_port="1026"/>
      <from sec="1041397470" usec="0"/>
      <to sec="1041397496" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="197.90.54.66" dst_port="137" proto="tcp" src_ip="144.52.72.113" src_port="1026"/>
      <filter dst_ip="197.90.54.66" dst_port="137" proto="udp" src_ip="144.52.72.113" src_port="1026"/>
      <filter dst_ip="197.90.54.66" dst_port="80" proto="tcp" src_ip="144.52.72.113" src_port="1026"/>
      <filter dst_ip="197.90.54.66" dst_port="80" proto="udp" src_ip="144.52.72.113" src_port="1026"/>
      <from sec="1041397480" usec="0"/>
      <to sec="1041397489" usec="0"/>
    </slice>
    <from sec="1041397470" usec="0"/>
    <to sec="1041397498" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.946667,1.87498,503,1 1 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_430{
style=filled;
color=gray75;
87[label="172.142.200.59s;1247pkt 1247fpkt", shape=rectangle, color=red];
752[label="172.142.200.59s;1pkt 1fpkt", shape=ellipse, color=green];
1271[label="172.142.200.59s;1pkt 1fpkt", shape=triangle, color=blue];
1693[label="172.142.200.59;s;2839pkt 2839fpkt", shape=diamond, color=yellow];
1745[label="200.183.107.203;d;1358pkt 1358fpkt", shape=diamond, color=yellow];
2334[label="218.159.205.20;d;40pkt 40fpkt", shape=diamond, color=yellow];
stat430[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.142.200.59:*, 200.183.107.203:80}[47.3629%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.4896%)&lt;BR/&gt; 443: (0.501276%)&lt;BR/&gt; 1031: (0.0455705%)&lt;BR/&gt; 4793: (0.0364564%)&lt;BR/&gt; 2444: (0.0364564%)&gt;];
}
87--752[label="1;1pkt 1fpkt"];
87--1271[label="1;1pkt 1fpkt"];
87--1693[label="0.994387;1240pkt 1240fpkt"];
87--1745[label="0.994387;1240pkt 1240fpkt"];
87--3275[label="0.010425;13pkt 13fpkt"];
87--3279[label="0.113071;141pkt 141fpkt"];
87--3283[label="0.0721732;90pkt 90fpkt"];
87--3284[label="0.0392943;49pkt 49fpkt"];
87--3289[label="0.010425;13pkt 13fpkt"];
87--3294[label="0.113071;141pkt 141fpkt"];
87--3298[label="0.010425;13pkt 13fpkt"];
752--1271[label="1;1pkt 1fpkt"];
752--1693[label="1;1pkt 1fpkt"];
752--1745[label="1;1pkt 1fpkt"];
1271--1693[label="1;1pkt 1fpkt"];
1271--1745[label="1;1pkt 1fpkt"];
1693--1745[label="1;1358pkt 1358fpkt"];
1693--1810[label="0.0647709;41pkt 41fpkt"];
1693--1972[label="0.0379009;13pkt 13fpkt"];
1693--2003[label="0.003861;2pkt 2fpkt"];
1693--2011[label="0.0165289;2pkt 2fpkt"];
1693--2017[label="0.385321;42pkt 42fpkt"];
1693--2148[label="0.00421941;1pkt 1fpkt"];
1693--2185[label="0.0597015;12pkt 12fpkt"];
1693--2208[label="0.130952;11pkt 11fpkt"];
1693--2257[label="0.0666667;6pkt 6fpkt"];
1693--2273[label="0.0197044;4pkt 4fpkt"];
1693--2283[label="0.0243902;2pkt 2fpkt"];
1693--2334[label="0.1;4pkt 4fpkt"];
1693--2339[label="0.035503;6pkt 6fpkt"];
1693--2381[label="0.0804598;21pkt 21fpkt"];
1693--2460[label="0.111111;10pkt 10fpkt"];
1693--2495[label="0.442623;27pkt 27fpkt"];
1693--2639[label="0.5;32pkt 32fpkt"];
1693--2647[label="0.0163934;1pkt 1fpkt"];
1693--2696[label="0.171429;12pkt 12fpkt"];
1693--2701[label="0.357143;15pkt 15fpkt"];
1693--2822[label="0.0206186;2pkt 2fpkt"];
1693--2855[label="0.00196078;1pkt 1fpkt"];
1693--2983[label="0.385321;42pkt 42fpkt"];
1693--3002[label="0.13253;11pkt 11fpkt"];
1693--3092[label="0.142857;20pkt 20fpkt"];
1693--3171[label="0.0196078;1pkt 1fpkt"];
1693--3207[label="0.372093;16pkt 16fpkt"];
1693--3248[label="0.0227273;2pkt 2fpkt"];
1693--3275[label="0.0604678;106pkt 106fpkt"];
1693--3279[label="0.0630504;179pkt 179fpkt"];
1693--3283[label="0.0510743;145pkt 145fpkt"];
1693--3284[label="0.038046;81pkt 81fpkt"];
1693--3289[label="0.0604333;106pkt 106fpkt"];
1693--3294[label="0.0630504;179pkt 179fpkt"];
1693--3298[label="0.0604678;106pkt 106fpkt"];
1745--3275[label="0.0338733;46pkt 46fpkt"];
1745--3279[label="0.103829;141pkt 141fpkt"];
1745--3283[label="0.0662739;90pkt 90fpkt"];
1745--3284[label="0.0309278;42pkt 42fpkt"];
1745--3289[label="0.0338733;46pkt 46fpkt"];
1745--3294[label="0.103829;141pkt 141fpkt"];
1745--3298[label="0.0338733;46pkt 46fpkt"];
2334--3275[label="0.05;2pkt 2fpkt"];
2334--3279[label="0.025;1pkt 1fpkt"];
2334--3289[label="0.05;2pkt 2fpkt"];
2334--3294[label="0.025;1pkt 1fpkt"];
2334--3298[label="0.05;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="200.183.107.203" dst_port="80" src_ip="172.142.200.59"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398766" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_431{
style=filled;
color=gray75;
89[label="61.160.70.0s;218pkt 218fpkt", shape=rectangle, color=red];
754[label="61.160.70.0s;120pkt 120fpkt", shape=ellipse, color=green];
1272[label="61.160.70.0s;120pkt 120fpkt", shape=triangle, color=blue];
3302[label="61.160.70.0;233pkt 233fpkt", shape=pentagon, color=darkviolet];
4400[label="61.160.70.0;232pkt 232fpkt", shape=invtriangle, color=brown];
stat431[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.160.70.0:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
89--754[label="1;120pkt 120fpkt"];
89--1272[label="1;120pkt 120fpkt"];
89--3302[label="1;218pkt 218fpkt"];
89--4400[label="0.995413;217pkt 217fpkt"];
754--1272[label="1;120pkt 120fpkt"];
754--3302[label="1;120pkt 120fpkt"];
754--4400[label="1;120pkt 120fpkt"];
1272--3302[label="1;120pkt 120fpkt"];
1272--4400[label="1;120pkt 120fpkt"];
3302--4400[label="1;232pkt 232fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.160.70.0" src_port="1028"/>
    </slice>
    <from sec="1041397916" usec="0"/>
    <to sec="1041397952" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_432{
style=filled;
color=gray75;
92[label="61.254.32.1s;186pkt 186fpkt", shape=rectangle, color=red];
756[label="61.254.32.1s;148pkt 148fpkt", shape=ellipse, color=green];
1273[label="61.254.32.1s;101pkt 101fpkt", shape=triangle, color=blue];
3308[label="61.254.32.1;184pkt 184fpkt", shape=pentagon, color=darkviolet];
4406[label="61.254.32.1;184pkt 184fpkt", shape=invtriangle, color=brown];
4993[label="61.254.32.1;184pkt 184fpkt", shape=invhouse, color=bisque];
stat432[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.254.32.1:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
92--756[label="1;148pkt 148fpkt"];
92--1273[label="1;101pkt 101fpkt"];
92--3308[label="1;184pkt 184fpkt"];
92--4406[label="1;184pkt 184fpkt"];
92--4993[label="1;184pkt 184fpkt"];
756--1273[label="1;101pkt 101fpkt"];
756--3308[label="0.993243;147pkt 147fpkt"];
756--4406[label="0.993243;147pkt 147fpkt"];
756--4993[label="0.993243;147pkt 147fpkt"];
1273--3308[label="0.990099;100pkt 100fpkt"];
1273--4406[label="0.990099;100pkt 100fpkt"];
1273--4993[label="0.990099;100pkt 100fpkt"];
3308--4406[label="1;184pkt 184fpkt"];
3308--4993[label="1;184pkt 184fpkt"];
4406--4993[label="1;184pkt 184fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.254.32.1" src_port="1027"/>
    </slice>
    <from sec="1041397776" usec="0"/>
    <to sec="1041397812" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_433{
style=filled;
color=gray75;
95[label="88.150.207.1s;120pkt 120fpkt", shape=rectangle, color=red];
759[label="88.150.207.1s;120pkt 120fpkt", shape=ellipse, color=green];
1274[label="88.150.207.1s;120pkt 120fpkt", shape=triangle, color=blue];
3312[label="88.150.207.1;119pkt 119fpkt", shape=pentagon, color=darkviolet];
4410[label="88.150.207.1;120pkt 120fpkt", shape=invtriangle, color=brown];
stat433[shape=component, label=&lt;Rules:&lt;BR/&gt;{88.150.207.1:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
95--759[label="1;120pkt 120fpkt"];
95--1274[label="1;120pkt 120fpkt"];
95--3312[label="1;119pkt 119fpkt"];
95--4410[label="1;120pkt 120fpkt"];
759--1274[label="1;120pkt 120fpkt"];
759--3312[label="1;119pkt 119fpkt"];
759--4410[label="1;120pkt 120fpkt"];
1274--3312[label="1;119pkt 119fpkt"];
1274--4410[label="1;120pkt 120fpkt"];
3312--4410[label="1;119pkt 119fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="88.150.207.1" src_port="1025"/>
    </slice>
    <from sec="1041398071" usec="0"/>
    <to sec="1041398090" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.765089,1.92048,002,0 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_434{
style=filled;
color=gray75;
761[label="61.254.228.1s;95pkt 95fpkt", shape=ellipse, color=green];
1276[label="61.254.228.1s;95pkt 95fpkt", shape=triangle, color=blue];
stat434[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.254.228.1:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
761--1276[label="1;95pkt 95fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.254.228.1" src_port="1025"/>
    </slice>
    <from sec="1041398282" usec="0"/>
    <to sec="1041398298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_435{
style=filled;
color=gray75;
102[label="61.254.40.4s;256pkt 256fpkt", shape=rectangle, color=red];
764[label="61.254.40.4s;256pkt 256fpkt", shape=ellipse, color=green];
1278[label="61.254.40.4s;256pkt 256fpkt", shape=triangle, color=blue];
stat435[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.254.40.4:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
102--764[label="1;256pkt 256fpkt"];
102--1278[label="1;256pkt 256fpkt"];
764--1278[label="1;256pkt 256fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.254.40.4" src_port="1026"/>
    </slice>
    <from sec="1041397561" usec="0"/>
    <to sec="1041397601" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_436{
style=filled;
color=gray75;
111[label="219.171.88.6s;227pkt 227fpkt", shape=rectangle, color=red];
770[label="219.171.88.6s;227pkt 227fpkt", shape=ellipse, color=green];
1282[label="219.171.88.6s;224pkt 224fpkt", shape=triangle, color=blue];
3347[label="219.171.88.6;227pkt 227fpkt", shape=pentagon, color=darkviolet];
4427[label="219.171.88.6;227pkt 227fpkt", shape=invtriangle, color=brown];
stat436[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.171.88.6:60983, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 60983: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
111--770[label="1;227pkt 227fpkt"];
111--1282[label="1;224pkt 224fpkt"];
111--3347[label="1;227pkt 227fpkt"];
111--4427[label="1;227pkt 227fpkt"];
770--1282[label="1;224pkt 224fpkt"];
770--3347[label="1;227pkt 227fpkt"];
770--4427[label="1;227pkt 227fpkt"];
1282--3347[label="1;224pkt 224fpkt"];
1282--4427[label="1;224pkt 224fpkt"];
3347--4427[label="1;227pkt 227fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="219.171.88.6" src_port="60983"/>
    </slice>
    <from sec="1041398336" usec="0"/>
    <to sec="1041398371" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,503,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_437{
style=filled;
color=gray75;
116[label="61.143.17.9s;1pkt 1fpkt", shape=rectangle, color=red];
775[label="61.143.17.9s;1pkt 1fpkt", shape=ellipse, color=green];
1287[label="61.143.17.9s;1pkt 1fpkt", shape=triangle, color=blue];
stat437[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.155.129.9:80, 63.119.66.209:59175}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 59175: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
116--775[label="1;1pkt 1fpkt"];
116--1287[label="1;1pkt 1fpkt"];
775--1287[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="63.119.66.209" dst_port="59175" src_ip="148.155.129.9" src_port="80"/>
    </slice>
    <from sec="1041398109" usec="0"/>
    <to sec="1041398125" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695213,1.95262,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="202.159.192.25" dst_port="137" proto="tcp" src_ip="61.161.206.11" src_port="1026"/>
      <filter dst_ip="202.159.192.25" dst_port="137" proto="udp" src_ip="61.161.206.11" src_port="1026"/>
      <filter dst_ip="202.159.192.25" dst_port="137" proto="tcp" src_ip="61.161.206.11" src_port="8080"/>
      <filter dst_ip="202.159.192.25" dst_port="137" proto="udp" src_ip="61.161.206.11" src_port="8080"/>
      <from sec="1041397564" usec="0"/>
      <to sec="1041397576" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="202.159.192.25" dst_port="137" proto="tcp" src_ip="203.37.98.11" src_port="1026"/>
      <filter dst_ip="202.159.192.25" dst_port="137" proto="udp" src_ip="203.37.98.11" src_port="1026"/>
      <filter dst_ip="202.159.192.25" dst_port="137" proto="tcp" src_ip="203.37.98.11" src_port="8080"/>
      <filter dst_ip="202.159.192.25" dst_port="137" proto="udp" src_ip="203.37.98.11" src_port="8080"/>
      <from sec="1041397561" usec="0"/>
      <to sec="1041397575" usec="0"/>
    </slice>
    <from sec="1041397561" usec="0"/>
    <to sec="1041397576" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_439{
style=filled;
color=gray75;
142[label="217.88.46.22s;118pkt 118fpkt", shape=rectangle, color=red];
795[label="217.88.46.22s;89pkt 89fpkt", shape=ellipse, color=green];
1304[label="217.88.46.22s;89pkt 89fpkt", shape=triangle, color=blue];
stat439[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.88.46.22:1204, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1204: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
142--795[label="1;89pkt 89fpkt"];
142--1304[label="1;89pkt 89fpkt"];
795--1304[label="1;89pkt 89fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.88.46.22" src_port="1204"/>
    </slice>
    <from sec="1041398346" usec="0"/>
    <to sec="1041398365" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_440{
style=filled;
color=gray75;
153[label="210.214.167.26s;109pkt 109fpkt", shape=rectangle, color=red];
804[label="210.214.167.26s;109pkt 109fpkt", shape=ellipse, color=green];
1311[label="210.214.167.26s;109pkt 109fpkt", shape=triangle, color=blue];
stat440[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.214.167.26:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
153--804[label="1;109pkt 109fpkt"];
153--1311[label="1;109pkt 109fpkt"];
804--1311[label="1;109pkt 109fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="210.214.167.26" src_port="1025"/>
    </slice>
    <from sec="1041398314" usec="0"/>
    <to sec="1041398331" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.06751,1.89274,002,1 0 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_441{
style=filled;
color=gray75;
159[label="217.49.64.28s;230pkt 230fpkt", shape=rectangle, color=red];
1314[label="217.49.64.28s;147pkt 147fpkt", shape=triangle, color=blue];
3468[label="217.49.64.28;230pkt 230fpkt", shape=pentagon, color=darkviolet];
4490[label="217.49.64.28;230pkt 230fpkt", shape=invtriangle, color=brown];
5033[label="217.49.64.28;229pkt 229fpkt", shape=invhouse, color=bisque];
stat441[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.49.64.28:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
159--1314[label="1;147pkt 147fpkt"];
159--3468[label="1;230pkt 230fpkt"];
159--4490[label="1;230pkt 230fpkt"];
159--5033[label="1;229pkt 229fpkt"];
1314--3468[label="1;147pkt 147fpkt"];
1314--4490[label="1;147pkt 147fpkt"];
1314--5033[label="1;147pkt 147fpkt"];
3468--4490[label="1;230pkt 230fpkt"];
3468--5033[label="1;229pkt 229fpkt"];
4490--5033[label="1;229pkt 229fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.49.64.28" src_port="1027"/>
    </slice>
    <from sec="1041397374" usec="0"/>
    <to sec="1041397413" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_442{
style=filled;
color=gray75;
161[label="61.165.212.28s;201pkt 201fpkt", shape=rectangle, color=red];
809[label="61.165.212.28s;103pkt 103fpkt", shape=ellipse, color=green];
1315[label="61.165.212.28s;103pkt 103fpkt", shape=triangle, color=blue];
3471[label="61.165.212.28;201pkt 201fpkt", shape=pentagon, color=darkviolet];
stat442[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.165.212.28:1025, *:137}[82.5871%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 1025: (44.2434%)&lt;BR/&gt; 1026: (5.75658%)&gt;];
}
161--809[label="1;103pkt 103fpkt"];
161--1315[label="1;103pkt 103fpkt"];
161--3471[label="1;201pkt 201fpkt"];
809--1315[label="1;103pkt 103fpkt"];
809--3471[label="1;103pkt 103fpkt"];
1315--3471[label="1;103pkt 103fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.165.212.28" src_port="1025"/>
    </slice>
    <from sec="1041398133" usec="0"/>
    <to sec="1041398374" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_443{
style=filled;
color=gray75;
167[label="91.118.200.30s;75pkt 75fpkt", shape=rectangle, color=red];
815[label="91.118.200.30s;75pkt 75fpkt", shape=ellipse, color=green];
1318[label="91.118.200.30s;75pkt 75fpkt", shape=triangle, color=blue];
stat443[shape=component, label=&lt;Rules:&lt;BR/&gt;{91.118.200.30:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
167--815[label="1;75pkt 75fpkt"];
167--1318[label="1;75pkt 75fpkt"];
815--1318[label="1;75pkt 75fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="91.118.200.30" src_port="1026"/>
    </slice>
    <from sec="1041398584" usec="0"/>
    <to sec="1041398598" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.765089,1.92048,501,0 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_444{
style=filled;
color=gray75;
822[label="136.234.119.35s;1pkt 1fpkt", shape=ellipse, color=green];
1323[label="136.234.119.35s;1pkt 1fpkt", shape=triangle, color=blue];
stat444[shape=component, label=&lt;Rules:&lt;BR/&gt;{213.22.99.35:1353, 136.234.78.149:21}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1353: (50%)&lt;BR/&gt; 21: (50%)&gt;];
}
822--1323[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="136.234.78.149" dst_port="21" src_ip="213.22.99.35" src_port="1353"/>
    </slice>
    <from sec="1041398800" usec="0"/>
    <to sec="1041398819" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695213,1.95262,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="61.203.141.37" src_port="1026"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="61.203.141.37" src_port="1026"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="61.203.141.37" src_port="1186"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="61.203.141.37" src_port="1186"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="61.203.141.37" src_port="80"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="61.203.141.37" src_port="80"/>
      <from sec="1041397233" usec="0"/>
      <to sec="1041397248" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="71.186.205.37" src_port="1026"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="71.186.205.37" src_port="1026"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="71.186.205.37" src_port="1186"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="71.186.205.37" src_port="1186"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="71.186.205.37" src_port="80"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="71.186.205.37" src_port="80"/>
      <from sec="1041397239" usec="0"/>
      <to sec="1041397248" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="90.222.33.37" src_port="1026"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="90.222.33.37" src_port="1026"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="90.222.33.37" src_port="1186"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="90.222.33.37" src_port="1186"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="tcp" src_ip="90.222.33.37" src_port="80"/>
      <filter dst_ip="202.159.192.34" dst_port="137" proto="udp" src_ip="90.222.33.37" src_port="80"/>
      <from sec="1041397235" usec="0"/>
      <to sec="1041397248" usec="0"/>
    </slice>
    <from sec="1041397233" usec="0"/>
    <to sec="1041397248" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_446{
style=filled;
color=gray75;
178[label="89.84.193.37s;140pkt 140fpkt", shape=rectangle, color=red];
824[label="89.84.193.37s;140pkt 140fpkt", shape=ellipse, color=green];
1325[label="89.84.193.37s;72pkt 72fpkt", shape=triangle, color=blue];
3507[label="89.84.193.37;140pkt 140fpkt", shape=pentagon, color=darkviolet];
stat446[shape=component, label=&lt;Rules:&lt;BR/&gt;{89.84.193.37:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
178--824[label="1;140pkt 140fpkt"];
178--1325[label="1;72pkt 72fpkt"];
178--3507[label="1;140pkt 140fpkt"];
824--1325[label="1;72pkt 72fpkt"];
824--3507[label="1;140pkt 140fpkt"];
1325--3507[label="1;72pkt 72fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="89.84.193.37" src_port="1029"/>
    </slice>
    <from sec="1041398163" usec="0"/>
    <to sec="1041398186" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695213,1.95262,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="202.159.194.95" dst_port="137" proto="udp" src_ip="61.206.116.42" src_port="10968"/>
      <filter dst_ip="202.159.194.95" dst_port="137" proto="icmp" src_ip="61.206.116.42" src_port="10968"/>
      <from sec="1041398249" usec="0"/>
      <to sec="1041398265" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="202.159.194.95" dst_port="137" proto="udp" src_ip="203.37.116.42" src_port="10968"/>
      <filter dst_ip="202.159.194.95" dst_port="137" proto="icmp" src_ip="203.37.116.42" src_port="10968"/>
      <from sec="1041398250" usec="0"/>
      <to sec="1041398264" usec="0"/>
    </slice>
    <from sec="1041398249" usec="0"/>
    <to sec="1041398265" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_448{
style=filled;
color=gray75;
188[label="202.247.117.43s;251pkt 251fpkt", shape=rectangle, color=red];
833[label="202.247.117.43s;84pkt 84fpkt", shape=ellipse, color=green];
1331[label="202.247.117.43s;84pkt 84fpkt", shape=triangle, color=blue];
3539[label="202.247.117.43;250pkt 250fpkt", shape=pentagon, color=darkviolet];
stat448[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.247.117.43:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
188--833[label="1;84pkt 84fpkt"];
188--1331[label="1;84pkt 84fpkt"];
188--3539[label="1;250pkt 250fpkt"];
833--1331[label="1;84pkt 84fpkt"];
833--3539[label="1;84pkt 84fpkt"];
1331--3539[label="1;84pkt 84fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="202.247.117.43" src_port="1028"/>
    </slice>
    <from sec="1041398409" usec="0"/>
    <to sec="1041398450" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695213,1.95262,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="141.0.187.243" dst_port="137" proto="tcp" src_ip="218.235.134.45" src_port="1028"/>
      <filter dst_ip="141.0.187.243" dst_port="137" proto="udp" src_ip="218.235.134.45" src_port="1028"/>
      <filter dst_ip="141.0.187.243" dst_port="2064" proto="tcp" src_ip="218.235.134.45" src_port="1028"/>
      <filter dst_ip="141.0.187.243" dst_port="2064" proto="udp" src_ip="218.235.134.45" src_port="1028"/>
      <filter dst_ip="145.117.103.184" dst_port="137" proto="tcp" src_ip="218.235.134.45" src_port="1028"/>
      <filter dst_ip="145.117.103.184" dst_port="137" proto="udp" src_ip="218.235.134.45" src_port="1028"/>
      <filter dst_ip="145.117.103.184" dst_port="2064" proto="tcp" src_ip="218.235.134.45" src_port="1028"/>
      <filter dst_ip="145.117.103.184" dst_port="2064" proto="udp" src_ip="218.235.134.45" src_port="1028"/>
      <from sec="1041397589" usec="0"/>
      <to sec="1041397604" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="141.0.187.243" dst_port="137" proto="tcp" src_ip="148.144.206.45" src_port="1028"/>
      <filter dst_ip="141.0.187.243" dst_port="137" proto="udp" src_ip="148.144.206.45" src_port="1028"/>
      <filter dst_ip="141.0.187.243" dst_port="2064" proto="tcp" src_ip="148.144.206.45" src_port="1028"/>
      <filter dst_ip="141.0.187.243" dst_port="2064" proto="udp" src_ip="148.144.206.45" src_port="1028"/>
      <filter dst_ip="145.117.103.184" dst_port="137" proto="tcp" src_ip="148.144.206.45" src_port="1028"/>
      <filter dst_ip="145.117.103.184" dst_port="137" proto="udp" src_ip="148.144.206.45" src_port="1028"/>
      <filter dst_ip="145.117.103.184" dst_port="2064" proto="tcp" src_ip="148.144.206.45" src_port="1028"/>
      <filter dst_ip="145.117.103.184" dst_port="2064" proto="udp" src_ip="148.144.206.45" src_port="1028"/>
      <from sec="1041397589" usec="0"/>
      <to sec="1041397605" usec="0"/>
    </slice>
    <from sec="1041397589" usec="0"/>
    <to sec="1041397605" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_450{
style=filled;
color=gray75;
207[label="61.93.140.52s;218pkt 218fpkt", shape=rectangle, color=red];
847[label="61.93.140.52s;218pkt 218fpkt", shape=ellipse, color=green];
1341[label="61.93.140.52s;218pkt 218fpkt", shape=triangle, color=blue];
stat450[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.93.140.52:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
207--847[label="1;218pkt 218fpkt"];
207--1341[label="1;218pkt 218fpkt"];
207--3285[label="0.802752;175pkt 175fpkt"];
847--1341[label="1;218pkt 218fpkt"];
847--3285[label="0.802752;175pkt 175fpkt"];
1341--3285[label="0.802752;175pkt 175fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.93.140.52" src_port="1026"/>
    </slice>
    <from sec="1041398750" usec="0"/>
    <to sec="1041398783" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_451{
style=filled;
color=gray75;
208[label="63.21.229.52s;78pkt 78fpkt", shape=rectangle, color=red];
848[label="63.21.229.52s;78pkt 78fpkt", shape=ellipse, color=green];
1342[label="63.21.229.52s;78pkt 78fpkt", shape=triangle, color=blue];
stat451[shape=component, label=&lt;Rules:&lt;BR/&gt;{63.21.229.52:1040, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1040: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
208--848[label="1;78pkt 78fpkt"];
208--1342[label="1;78pkt 78fpkt"];
848--1342[label="1;78pkt 78fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="63.21.229.52" src_port="1040"/>
    </slice>
    <from sec="1041397799" usec="0"/>
    <to sec="1041397813" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.17829,1.90003,999,0 1 1 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_452{
style=filled;
color=gray75;
852[label="212.247.138.55s;1pkt 1fpkt", shape=ellipse, color=green];
1345[label="212.247.138.55s;1pkt 1fpkt", shape=triangle, color=blue];
2304[label="62.54.86.55;s;2pkt 2fpkt", shape=diamond, color=yellow];
2987[label="62.54.86.55;s;2pkt 2fpkt", shape=hexagon, color=black];
3581[label="62.54.86.55;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat452[shape=component, label=&lt;Rules:&lt;BR/&gt;{62.54.86.55:4662, 168.125.47.240:2062}[50%]&lt;BR/&gt;{62.54.86.55:4662, 168.125.47.240:2091}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4662: (50%)&lt;BR/&gt; 2091: (35.7143%)&lt;BR/&gt; 2062: (14.2857%)&gt;];
}
852--1345[label="1;1pkt 1fpkt"];
852--1648[label="1;1pkt 1fpkt"];
852--2304[label="1;1pkt 1fpkt"];
852--2987[label="1;1pkt 1fpkt"];
852--3581[label="1;1pkt 1fpkt"];
1345--1648[label="1;1pkt 1fpkt"];
1345--2304[label="1;1pkt 1fpkt"];
1345--2987[label="1;1pkt 1fpkt"];
1345--3581[label="1;1pkt 1fpkt"];
2304--2987[label="1;2pkt 2fpkt"];
2304--3581[label="1;1pkt 1fpkt"];
2987--3581[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="168.125.47.240" dst_port="2091" src_ip="62.54.86.55" src_port="4662"/>
      <filter dst_ip="168.125.47.240" dst_port="2062" src_ip="62.54.86.55" src_port="4662"/>
    </slice>
    <from sec="1041397803" usec="0"/>
    <to sec="1041398696" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_453{
style=filled;
color=gray75;
215[label="217.84.6.57s;212pkt 212fpkt", shape=rectangle, color=red];
854[label="217.84.6.57s;212pkt 212fpkt", shape=ellipse, color=green];
1346[label="217.84.6.57s;120pkt 120fpkt", shape=triangle, color=blue];
stat453[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.84.6.57:1087, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1087: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
215--854[label="1;212pkt 212fpkt"];
215--1346[label="1;120pkt 120fpkt"];
215--3280[label="0.254717;54pkt 54fpkt"];
215--3295[label="0.254717;54pkt 54fpkt"];
854--1346[label="1;120pkt 120fpkt"];
854--3280[label="0.254717;54pkt 54fpkt"];
854--3295[label="0.254717;54pkt 54fpkt"];
1346--3280[label="0.45;54pkt 54fpkt"];
1346--3295[label="0.45;54pkt 54fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.84.6.57" src_port="1087"/>
    </slice>
    <from sec="1041398436" usec="0"/>
    <to sec="1041398467" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_454{
style=filled;
color=gray75;
217[label="4.128.181.58s;128pkt 128fpkt", shape=rectangle, color=red];
855[label="4.128.181.58s;128pkt 128fpkt", shape=ellipse, color=green];
1347[label="4.128.181.58s;128pkt 128fpkt", shape=triangle, color=blue];
3594[label="4.128.181.58;128pkt 128fpkt", shape=pentagon, color=darkviolet];
4558[label="4.128.181.58;127pkt 127fpkt", shape=invtriangle, color=brown];
stat454[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.128.181.58:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
217--855[label="1;128pkt 128fpkt"];
217--1347[label="1;128pkt 128fpkt"];
217--3594[label="1;128pkt 128fpkt"];
217--4558[label="1;127pkt 127fpkt"];
855--1347[label="1;128pkt 128fpkt"];
855--3594[label="1;128pkt 128fpkt"];
855--4558[label="1;127pkt 127fpkt"];
1347--3594[label="1;128pkt 128fpkt"];
1347--4558[label="1;127pkt 127fpkt"];
3594--4558[label="1;127pkt 127fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="4.128.181.58" src_port="1029"/>
    </slice>
    <from sec="1041397954" usec="0"/>
    <to sec="1041397976" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_455{
style=filled;
color=gray75;
219[label="217.61.4.60s;184pkt 184fpkt", shape=rectangle, color=red];
856[label="217.61.4.60s;184pkt 184fpkt", shape=ellipse, color=green];
1348[label="217.61.4.60s;96pkt 96fpkt", shape=triangle, color=blue];
stat455[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.61.4.60:1166, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1166: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
219--856[label="1;184pkt 184fpkt"];
219--1348[label="1;96pkt 96fpkt"];
856--1348[label="1;96pkt 96fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.61.4.60" src_port="1166"/>
    </slice>
    <from sec="1041397363" usec="0"/>
    <to sec="1041397396" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_456{
style=filled;
color=gray75;
224[label="219.138.9.64s;191pkt 191fpkt", shape=rectangle, color=red];
859[label="219.138.9.64s;109pkt 109fpkt", shape=ellipse, color=green];
1351[label="219.138.9.64s;109pkt 109fpkt", shape=triangle, color=blue];
3614[label="219.138.9.64;190pkt 190fpkt", shape=pentagon, color=darkviolet];
stat456[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.138.9.64:63525, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 63525: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
224--859[label="1;109pkt 109fpkt"];
224--1351[label="1;109pkt 109fpkt"];
224--3614[label="1;190pkt 190fpkt"];
859--1351[label="1;109pkt 109fpkt"];
859--3614[label="0.990826;108pkt 108fpkt"];
1351--3614[label="0.990826;108pkt 108fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="219.138.9.64" src_port="63525"/>
    </slice>
    <from sec="1041397613" usec="0"/>
    <to sec="1041397644" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_457{
style=filled;
color=gray75;
225[label="217.67.181.65s;224pkt 224fpkt", shape=rectangle, color=red];
860[label="217.67.181.65s;224pkt 224fpkt", shape=ellipse, color=green];
1352[label="217.67.181.65s;207pkt 207fpkt", shape=triangle, color=blue];
3627[label="217.67.181.65;274pkt 274fpkt", shape=pentagon, color=darkviolet];
4574[label="217.67.181.65;274pkt 274fpkt", shape=invtriangle, color=brown];
stat457[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.67.181.65:17394, *:137}[92%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 17394: (48.1712%)&lt;BR/&gt; 23149: (1.82876%)&gt;];
}
225--860[label="1;224pkt 224fpkt"];
225--1352[label="1;207pkt 207fpkt"];
225--3627[label="0.995536;223pkt 223fpkt"];
225--4574[label="0.995536;223pkt 223fpkt"];
860--1352[label="1;207pkt 207fpkt"];
860--3627[label="0.995536;223pkt 223fpkt"];
860--4574[label="0.995536;223pkt 223fpkt"];
1352--3627[label="0.995169;206pkt 206fpkt"];
1352--4574[label="0.995169;206pkt 206fpkt"];
3627--4574[label="1;274pkt 274fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.67.181.65" src_port="17394"/>
    </slice>
    <from sec="1041397701" usec="0"/>
    <to sec="1041398281" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_459{
style=filled;
color=gray75;
236[label="218.248.172.69s;248pkt 248fpkt", shape=rectangle, color=red];
869[label="218.248.172.69s;248pkt 248fpkt", shape=ellipse, color=green];
1359[label="218.248.172.69s;183pkt 183fpkt", shape=triangle, color=blue];
stat459[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.248.172.69:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
236--869[label="1;248pkt 248fpkt"];
236--1359[label="1;183pkt 183fpkt"];
869--1359[label="1;183pkt 183fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="218.248.172.69" src_port="1026"/>
    </slice>
    <from sec="1041398164" usec="0"/>
    <to sec="1041398205" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_460{
style=filled;
color=gray75;
246[label="61.206.22.74s;78pkt 78fpkt", shape=rectangle, color=red];
877[label="61.206.22.74s;78pkt 78fpkt", shape=ellipse, color=green];
1363[label="61.206.22.74s;78pkt 78fpkt", shape=triangle, color=blue];
stat460[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.206.22.74:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
246--877[label="1;78pkt 78fpkt"];
246--1363[label="1;78pkt 78fpkt"];
877--1363[label="1;78pkt 78fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.206.22.74" src_port="1027"/>
    </slice>
    <from sec="1041398618" usec="0"/>
    <to sec="1041398631" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,503,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_461{
style=filled;
color=gray75;
252[label="4.71.163.76s;1pkt 1fpkt", shape=rectangle, color=red];
882[label="4.71.163.76s;1pkt 1fpkt", shape=ellipse, color=green];
1366[label="4.71.163.76s;1pkt 1fpkt", shape=triangle, color=blue];
stat461[shape=component, label=&lt;Rules:&lt;BR/&gt;{90.199.83.76:17312, 202.159.238.113:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 17312: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
252--882[label="1;1pkt 1fpkt"];
252--1366[label="1;1pkt 1fpkt"];
882--1366[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="202.159.238.113" dst_port="80" src_ip="90.199.83.76" src_port="17312"/>
    </slice>
    <from sec="1041398219" usec="0"/>
    <to sec="1041398235" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_462{
style=filled;
color=gray75;
255[label="217.36.18.80s;129pkt 129fpkt", shape=rectangle, color=red];
885[label="217.36.18.80s;129pkt 129fpkt", shape=ellipse, color=green];
1368[label="217.36.18.80s;129pkt 129fpkt", shape=triangle, color=blue];
3688[label="217.36.18.80;227pkt 227fpkt", shape=pentagon, color=darkviolet];
4600[label="217.36.18.80;227pkt 227fpkt", shape=invtriangle, color=brown];
5091[label="217.36.18.80;227pkt 227fpkt", shape=invhouse, color=bisque];
stat462[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.36.18.80:22627, *:137}[56.8282%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 22627: (36.236%)&lt;BR/&gt; 22626: (2.38764%)&lt;BR/&gt; 22614: (2.38764%)&lt;BR/&gt; 22617: (1.1236%)&gt;];
}
255--885[label="1;129pkt 129fpkt"];
255--1368[label="1;129pkt 129fpkt"];
255--3688[label="1;129pkt 129fpkt"];
255--4600[label="1;129pkt 129fpkt"];
255--5091[label="1;129pkt 129fpkt"];
885--1368[label="1;129pkt 129fpkt"];
885--3688[label="1;129pkt 129fpkt"];
885--4600[label="1;129pkt 129fpkt"];
885--5091[label="1;129pkt 129fpkt"];
1368--3688[label="1;129pkt 129fpkt"];
1368--4600[label="1;129pkt 129fpkt"];
1368--5091[label="1;129pkt 129fpkt"];
3688--4600[label="1;227pkt 227fpkt"];
3688--5091[label="1;227pkt 227fpkt"];
4600--5091[label="1;227pkt 227fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.36.18.80" src_port="22627"/>
    </slice>
    <from sec="1041397586" usec="0"/>
    <to sec="1041397622" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_463{
style=filled;
color=gray75;
262[label="63.37.2.84s;71pkt 71fpkt", shape=rectangle, color=red];
891[label="63.37.2.84s;71pkt 71fpkt", shape=ellipse, color=green];
1373[label="63.37.2.84s;71pkt 71fpkt", shape=triangle, color=blue];
stat463[shape=component, label=&lt;Rules:&lt;BR/&gt;{63.37.2.84:22435, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 22435: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
262--891[label="1;71pkt 71fpkt"];
262--1373[label="1;71pkt 71fpkt"];
891--1373[label="1;71pkt 71fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="63.37.2.84" src_port="22435"/>
    </slice>
    <from sec="1041398344" usec="0"/>
    <to sec="1041398359" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_464{
style=filled;
color=gray75;
270[label="203.208.0.88s;182pkt 182fpkt", shape=rectangle, color=red];
896[label="203.208.0.88s;140pkt 140fpkt", shape=ellipse, color=green];
1375[label="203.208.0.88s;93pkt 93fpkt", shape=triangle, color=blue];
3723[label="203.208.0.88;181pkt 181fpkt", shape=pentagon, color=darkviolet];
4619[label="203.208.0.88;181pkt 181fpkt", shape=invtriangle, color=brown];
stat464[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.208.0.88:1030, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1030: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
270--896[label="1;140pkt 140fpkt"];
270--1375[label="1;93pkt 93fpkt"];
270--3723[label="1;181pkt 181fpkt"];
270--4619[label="1;181pkt 181fpkt"];
896--1375[label="1;93pkt 93fpkt"];
896--3723[label="0.992857;139pkt 139fpkt"];
896--4619[label="0.992857;139pkt 139fpkt"];
1375--3723[label="1;93pkt 93fpkt"];
1375--4619[label="1;93pkt 93fpkt"];
3723--4619[label="1;181pkt 181fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="203.208.0.88" src_port="1030"/>
    </slice>
    <from sec="1041397437" usec="0"/>
    <to sec="1041397466" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_465{
style=filled;
color=gray75;
275[label="70.50.67.90s;248pkt 248fpkt", shape=rectangle, color=red];
901[label="70.50.67.90s;213pkt 213fpkt", shape=ellipse, color=green];
1378[label="70.50.67.90s;213pkt 213fpkt", shape=triangle, color=blue];
3733[label="70.50.67.90;247pkt 247fpkt", shape=pentagon, color=darkviolet];
4624[label="70.50.67.90;247pkt 247fpkt", shape=invtriangle, color=brown];
stat465[shape=component, label=&lt;Rules:&lt;BR/&gt;{70.50.67.90:1024, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1024: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
275--901[label="1;213pkt 213fpkt"];
275--1378[label="1;213pkt 213fpkt"];
275--3733[label="1;247pkt 247fpkt"];
275--4624[label="1;247pkt 247fpkt"];
901--1378[label="1;213pkt 213fpkt"];
901--3733[label="0.995305;212pkt 212fpkt"];
901--4624[label="0.995305;212pkt 212fpkt"];
1378--3733[label="0.995305;212pkt 212fpkt"];
1378--4624[label="0.995305;212pkt 212fpkt"];
3733--4624[label="1;247pkt 247fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="70.50.67.90" src_port="1024"/>
    </slice>
    <from sec="1041398127" usec="0"/>
    <to sec="1041398174" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.620401,1.94046,002,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_466{
style=filled;
color=gray75;
906[label="88.126.199.93s;79pkt 79fpkt", shape=ellipse, color=green];
stat466[shape=component, label=&lt;Rules:&lt;BR/&gt;{88.126.199.93:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
906--1381[label="1;79pkt 79fpkt"];
906--3280[label="0.164557;13pkt 13fpkt"];
906--3295[label="0.164557;13pkt 13fpkt"];
906--3746[label="0.987342;78pkt 78fpkt"];
906--4631[label="0.987342;78pkt 78fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="88.126.199.93" src_port="1025"/>
    </slice>
    <from sec="1041398450" usec="0"/>
    <to sec="1041398462" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_467{
style=filled;
color=gray75;
288[label="211.2.41.97s;67pkt 67fpkt", shape=rectangle, color=red];
913[label="211.2.41.97s;67pkt 67fpkt", shape=ellipse, color=green];
1387[label="211.2.41.97s;67pkt 67fpkt", shape=triangle, color=blue];
stat467[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.2.41.97:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
288--913[label="1;67pkt 67fpkt"];
288--1387[label="1;67pkt 67fpkt"];
913--1387[label="1;67pkt 67fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="211.2.41.97" src_port="1025"/>
    </slice>
    <from sec="1041398536" usec="0"/>
    <to sec="1041398550" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_468{
style=filled;
color=gray75;
306[label="209.186.133.107s;242pkt 242fpkt", shape=rectangle, color=red];
928[label="209.186.133.107s;242pkt 242fpkt", shape=ellipse, color=green];
1398[label="209.186.133.107s;69pkt 69fpkt", shape=triangle, color=blue];
3803[label="209.186.133.107;242pkt 242fpkt", shape=pentagon, color=darkviolet];
4663[label="209.186.133.107;242pkt 242fpkt", shape=invtriangle, color=brown];
stat468[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.186.133.107:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
306--928[label="1;242pkt 242fpkt"];
306--1398[label="1;69pkt 69fpkt"];
306--3276[label="0.330579;80pkt 80fpkt"];
306--3290[label="0.330579;80pkt 80fpkt"];
306--3299[label="0.330579;80pkt 80fpkt"];
306--3803[label="1;242pkt 242fpkt"];
306--4663[label="1;242pkt 242fpkt"];
928--1398[label="1;69pkt 69fpkt"];
928--3276[label="0.330579;80pkt 80fpkt"];
928--3290[label="0.330579;80pkt 80fpkt"];
928--3299[label="0.330579;80pkt 80fpkt"];
928--3803[label="1;242pkt 242fpkt"];
928--4663[label="1;242pkt 242fpkt"];
1398--3803[label="1;69pkt 69fpkt"];
1398--4663[label="1;69pkt 69fpkt"];
3803--4663[label="1;242pkt 242fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="209.186.133.107" src_port="1029"/>
    </slice>
    <from sec="1041397233" usec="0"/>
    <to sec="1041397277" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_469{
style=filled;
color=gray75;
309[label="211.30.97.108s;127pkt 127fpkt", shape=rectangle, color=red];
930[label="211.30.97.108s;127pkt 127fpkt", shape=ellipse, color=green];
1399[label="211.30.97.108s;127pkt 127fpkt", shape=triangle, color=blue];
3805[label="211.30.97.108;143pkt 143fpkt", shape=pentagon, color=darkviolet];
stat469[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.30.97.108:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
309--930[label="1;127pkt 127fpkt"];
309--1399[label="1;127pkt 127fpkt"];
309--3805[label="1;127pkt 127fpkt"];
930--1399[label="1;127pkt 127fpkt"];
930--3805[label="1;127pkt 127fpkt"];
1399--3805[label="1;127pkt 127fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="211.30.97.108" src_port="1029"/>
    </slice>
    <from sec="1041398614" usec="0"/>
    <to sec="1041398636" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_470{
style=filled;
color=gray75;
324[label="61.217.39.114s;188pkt 188fpkt", shape=rectangle, color=red];
944[label="61.217.39.114s;188pkt 188fpkt", shape=ellipse, color=green];
1413[label="61.217.39.114s;128pkt 128fpkt", shape=triangle, color=blue];
3839[label="61.217.39.114;187pkt 187fpkt", shape=pentagon, color=darkviolet];
4683[label="61.217.39.114;188pkt 188fpkt", shape=invtriangle, color=brown];
stat470[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.217.39.114:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
324--944[label="1;188pkt 188fpkt"];
324--1413[label="1;128pkt 128fpkt"];
324--3839[label="1;187pkt 187fpkt"];
324--4683[label="1;188pkt 188fpkt"];
944--1413[label="1;128pkt 128fpkt"];
944--3839[label="1;187pkt 187fpkt"];
944--4683[label="1;188pkt 188fpkt"];
1413--3839[label="0.992188;127pkt 127fpkt"];
1413--4683[label="1;128pkt 128fpkt"];
3839--4683[label="1;187pkt 187fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.217.39.114" src_port="1025"/>
    </slice>
    <from sec="1041398062" usec="0"/>
    <to sec="1041398091" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_471{
style=filled;
color=gray75;
326[label="90.94.197.114s;143pkt 143fpkt", shape=rectangle, color=red];
946[label="90.94.197.114s;105pkt 105fpkt", shape=ellipse, color=green];
1414[label="90.94.197.114s;105pkt 105fpkt", shape=triangle, color=blue];
stat471[shape=component, label=&lt;Rules:&lt;BR/&gt;{90.94.197.114:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
326--946[label="1;105pkt 105fpkt"];
326--1414[label="1;105pkt 105fpkt"];
946--1414[label="1;105pkt 105fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="90.94.197.114" src_port="1025"/>
    </slice>
    <from sec="1041398408" usec="0"/>
    <to sec="1041398430" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_472{
style=filled;
color=gray75;
332[label="217.57.115.117s;71pkt 71fpkt", shape=rectangle, color=red];
951[label="217.57.115.117s;71pkt 71fpkt", shape=ellipse, color=green];
1420[label="217.57.115.117s;71pkt 71fpkt", shape=triangle, color=blue];
stat472[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.57.115.117:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
332--951[label="1;71pkt 71fpkt"];
332--1420[label="1;71pkt 71fpkt"];
951--1420[label="1;71pkt 71fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.57.115.117" src_port="1028"/>
    </slice>
    <from sec="1041398598" usec="0"/>
    <to sec="1041398609" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_473{
style=filled;
color=gray75;
337[label="91.33.185.121s;125pkt 125fpkt", shape=rectangle, color=red];
956[label="91.33.185.121s;101pkt 101fpkt", shape=ellipse, color=green];
1423[label="91.33.185.121s;101pkt 101fpkt", shape=triangle, color=blue];
3868[label="91.33.185.121;153pkt 153fpkt", shape=pentagon, color=darkviolet];
4701[label="91.33.185.121;152pkt 152fpkt", shape=invtriangle, color=brown];
stat473[shape=component, label=&lt;Rules:&lt;BR/&gt;{91.33.185.121:1031, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1031: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
337--956[label="1;101pkt 101fpkt"];
337--1423[label="1;101pkt 101fpkt"];
337--3868[label="1;125pkt 125fpkt"];
337--4701[label="0.992;124pkt 124fpkt"];
956--1423[label="1;101pkt 101fpkt"];
956--3868[label="1;101pkt 101fpkt"];
956--4701[label="0.990099;100pkt 100fpkt"];
1423--3868[label="1;101pkt 101fpkt"];
1423--4701[label="0.990099;100pkt 100fpkt"];
3868--4701[label="1;152pkt 152fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="91.33.185.121" src_port="1031"/>
    </slice>
    <from sec="1041397308" usec="0"/>
    <to sec="1041397333" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_474{
style=filled;
color=gray75;
338[label="216.239.65.122s;94pkt 94fpkt", shape=rectangle, color=red];
957[label="216.239.65.122s;94pkt 94fpkt", shape=ellipse, color=green];
1424[label="216.239.65.122s;94pkt 94fpkt", shape=triangle, color=blue];
stat474[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.239.65.122:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
338--957[label="1;94pkt 94fpkt"];
338--1424[label="1;94pkt 94fpkt"];
957--1424[label="1;94pkt 94fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="216.239.65.122" src_port="1026"/>
    </slice>
    <from sec="1041397515" usec="0"/>
    <to sec="1041397530" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_475{
style=filled;
color=gray75;
346[label="61.228.19.126s;398pkt 398fpkt", shape=rectangle, color=red];
964[label="61.228.19.126s;354pkt 354fpkt", shape=ellipse, color=green];
1428[label="61.228.19.126s;354pkt 354fpkt", shape=triangle, color=blue];
3887[label="61.228.19.126;417pkt 417fpkt", shape=pentagon, color=darkviolet];
4713[label="61.228.19.126;417pkt 417fpkt", shape=invtriangle, color=brown];
stat475[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.228.19.126:1027, *:137}[56.3246%]&lt;BR/&gt;{61.228.19.126:1025, *:137}[43.6754%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 1027: (28.7371%)&lt;BR/&gt; 1025: (21.2629%)&gt;];
}
346--964[label="1;354pkt 354fpkt"];
346--1428[label="1;354pkt 354fpkt"];
346--3887[label="0.994975;396pkt 396fpkt"];
346--4713[label="0.994975;396pkt 396fpkt"];
964--1428[label="1;354pkt 354fpkt"];
964--3887[label="0.997175;353pkt 353fpkt"];
964--4713[label="0.997175;353pkt 353fpkt"];
1428--3887[label="0.997175;353pkt 353fpkt"];
1428--4713[label="0.997175;353pkt 353fpkt"];
3887--4713[label="1;417pkt 417fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.228.19.126" src_port="1027"/>
      <filter dst_port="137" src_ip="61.228.19.126" src_port="1025"/>
    </slice>
    <from sec="1041397290" usec="0"/>
    <to sec="1041397962" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.649115,1.85851,002,1 1 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_476{
style=filled;
color=gray75;
180[label="210.228.69.38s;186pkt 186fpkt", shape=rectangle, color=red];
826[label="210.228.69.38s;137pkt 137fpkt", shape=ellipse, color=green];
3511[label="210.228.69.38;186pkt 186fpkt", shape=pentagon, color=darkviolet];
stat476[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.228.69.38:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
180--826[label="1;137pkt 137fpkt"];
180--1429[label="0.736559;137pkt 137fpkt"];
180--3511[label="1;186pkt 186fpkt"];
826--1429[label="1;137pkt 137fpkt"];
826--3511[label="1;137pkt 137fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="210.228.69.38" src_port="1026"/>
    </slice>
    <from sec="1041397847" usec="0"/>
    <to sec="1041397887" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_477{
style=filled;
color=gray75;
350[label="200.187.243.126s;102pkt 102fpkt", shape=rectangle, color=red];
967[label="200.187.243.126s;70pkt 70fpkt", shape=ellipse, color=green];
1431[label="200.187.243.126s;70pkt 70fpkt", shape=triangle, color=blue];
3891[label="200.187.243.126;102pkt 102fpkt", shape=pentagon, color=darkviolet];
4715[label="200.187.243.126;101pkt 101fpkt", shape=invtriangle, color=brown];
5154[label="200.187.243.126;101pkt 101fpkt", shape=invhouse, color=bisque];
stat477[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.187.243.126:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
350--967[label="1;70pkt 70fpkt"];
350--1431[label="1;70pkt 70fpkt"];
350--3891[label="1;102pkt 102fpkt"];
350--4715[label="1;101pkt 101fpkt"];
350--5154[label="1;101pkt 101fpkt"];
967--1431[label="1;70pkt 70fpkt"];
967--3891[label="1;70pkt 70fpkt"];
967--4715[label="1;70pkt 70fpkt"];
967--5154[label="1;70pkt 70fpkt"];
1431--3891[label="1;70pkt 70fpkt"];
1431--4715[label="1;70pkt 70fpkt"];
1431--5154[label="1;70pkt 70fpkt"];
3891--4715[label="1;101pkt 101fpkt"];
3891--5154[label="1;101pkt 101fpkt"];
4715--5154[label="1;101pkt 101fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="200.187.243.126" src_port="1028"/>
    </slice>
    <from sec="1041398510" usec="0"/>
    <to sec="1041398528" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_478{
style=filled;
color=gray75;
352[label="89.114.162.127s;178pkt 178fpkt", shape=rectangle, color=red];
969[label="89.114.162.127s;178pkt 178fpkt", shape=ellipse, color=green];
1433[label="89.114.162.127s;117pkt 117fpkt", shape=triangle, color=blue];
stat478[shape=component, label=&lt;Rules:&lt;BR/&gt;{89.114.162.127:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
352--969[label="1;178pkt 178fpkt"];
352--1433[label="1;117pkt 117fpkt"];
352--3280[label="0.634831;113pkt 113fpkt"];
352--3295[label="0.634831;113pkt 113fpkt"];
969--1433[label="1;117pkt 117fpkt"];
969--3280[label="0.634831;113pkt 113fpkt"];
969--3295[label="0.634831;113pkt 113fpkt"];
1433--3280[label="0.444444;52pkt 52fpkt"];
1433--3295[label="0.444444;52pkt 52fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="89.114.162.127" src_port="1028"/>
    </slice>
    <from sec="1041398488" usec="0"/>
    <to sec="1041398516" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_479{
style=filled;
color=gray75;
353[label="174.48.122.128s;108pkt 108fpkt", shape=rectangle, color=red];
970[label="174.48.122.128s;108pkt 108fpkt", shape=ellipse, color=green];
1434[label="174.48.122.128s;108pkt 108fpkt", shape=triangle, color=blue];
stat479[shape=component, label=&lt;Rules:&lt;BR/&gt;{174.48.122.128:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
353--970[label="1;108pkt 108fpkt"];
353--1434[label="1;108pkt 108fpkt"];
970--1434[label="1;108pkt 108fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="174.48.122.128" src_port="1028"/>
    </slice>
    <from sec="1041397414" usec="0"/>
    <to sec="1041397432" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695213,1.95262,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="192.211.37.53" dst_port="137" proto="tcp" src_ip="211.65.99.133" src_port="62414"/>
      <filter dst_ip="192.211.37.53" dst_port="137" proto="udp" src_ip="211.65.99.133" src_port="62414"/>
      <filter dst_ip="192.211.37.53" dst_port="80" proto="tcp" src_ip="211.65.99.133" src_port="62414"/>
      <filter dst_ip="192.211.37.53" dst_port="80" proto="udp" src_ip="211.65.99.133" src_port="62414"/>
      <from sec="1041397768" usec="0"/>
      <to sec="1041397784" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="192.211.37.53" dst_port="137" proto="tcp" src_ip="136.234.91.133" src_port="62414"/>
      <filter dst_ip="192.211.37.53" dst_port="137" proto="udp" src_ip="136.234.91.133" src_port="62414"/>
      <filter dst_ip="192.211.37.53" dst_port="80" proto="tcp" src_ip="136.234.91.133" src_port="62414"/>
      <filter dst_ip="192.211.37.53" dst_port="80" proto="udp" src_ip="136.234.91.133" src_port="62414"/>
      <from sec="1041397768" usec="0"/>
      <to sec="1041397781" usec="0"/>
    </slice>
    <from sec="1041397768" usec="0"/>
    <to sec="1041397784" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_482{
style=filled;
color=gray75;
378[label="61.254.27.135s;162pkt 162fpkt", shape=rectangle, color=red];
985[label="61.254.27.135s;69pkt 69fpkt", shape=ellipse, color=green];
1443[label="61.254.27.135s;69pkt 69fpkt", shape=triangle, color=blue];
3943[label="61.254.27.135;223pkt 223fpkt", shape=pentagon, color=darkviolet];
4746[label="61.254.27.135;222pkt 222fpkt", shape=invtriangle, color=brown];
stat482[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.254.27.135:1035, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1035: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
378--985[label="1;69pkt 69fpkt"];
378--1443[label="1;69pkt 69fpkt"];
378--3943[label="1;162pkt 162fpkt"];
378--4746[label="0.993827;161pkt 161fpkt"];
985--1443[label="1;69pkt 69fpkt"];
985--3943[label="1;69pkt 69fpkt"];
985--4746[label="1;69pkt 69fpkt"];
1443--3943[label="1;69pkt 69fpkt"];
1443--4746[label="1;69pkt 69fpkt"];
3943--4746[label="1;222pkt 222fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.254.27.135" src_port="1035"/>
    </slice>
    <from sec="1041397253" usec="0"/>
    <to sec="1041397292" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_483{
style=filled;
color=gray75;
379[label="61.167.69.135s;225pkt 225fpkt", shape=rectangle, color=red];
986[label="61.167.69.135s;225pkt 225fpkt", shape=ellipse, color=green];
1444[label="61.167.69.135s;225pkt 225fpkt", shape=triangle, color=blue];
3944[label="61.167.69.135;249pkt 249fpkt", shape=pentagon, color=darkviolet];
stat483[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.167.69.135:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
379--986[label="1;225pkt 225fpkt"];
379--1444[label="1;225pkt 225fpkt"];
379--3944[label="1;225pkt 225fpkt"];
986--1444[label="1;225pkt 225fpkt"];
986--3944[label="1;225pkt 225fpkt"];
1444--3944[label="1;225pkt 225fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.167.69.135" src_port="1028"/>
    </slice>
    <from sec="1041398341" usec="0"/>
    <to sec="1041398391" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_484{
style=filled;
color=gray75;
381[label="61.98.135.137s;175pkt 175fpkt", shape=rectangle, color=red];
988[label="61.98.135.137s;145pkt 145fpkt", shape=ellipse, color=green];
1446[label="61.98.135.137s;89pkt 89fpkt", shape=triangle, color=blue];
3955[label="61.98.135.137;212pkt 212fpkt", shape=pentagon, color=darkviolet];
4753[label="61.98.135.137;212pkt 212fpkt", shape=invtriangle, color=brown];
stat484[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.98.135.137:12787, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 12787: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
381--988[label="1;145pkt 145fpkt"];
381--1446[label="1;89pkt 89fpkt"];
381--3955[label="0.994286;174pkt 174fpkt"];
381--4753[label="0.994286;174pkt 174fpkt"];
988--1446[label="1;89pkt 89fpkt"];
988--3955[label="0.993103;144pkt 144fpkt"];
988--4753[label="0.993103;144pkt 144fpkt"];
1446--3955[label="0.988764;88pkt 88fpkt"];
1446--4753[label="0.988764;88pkt 88fpkt"];
3955--4753[label="1;212pkt 212fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.98.135.137" src_port="12787"/>
    </slice>
    <from sec="1041397555" usec="0"/>
    <to sec="1041397590" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.880208,1.86376,002,0 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_486{
style=filled;
color=gray75;
994[label="4.146.24.140s;94pkt 94fpkt", shape=ellipse, color=green];
1451[label="4.146.24.140s;94pkt 94fpkt", shape=triangle, color=blue];
3970[label="4.146.24.140;196pkt 196fpkt", shape=pentagon, color=darkviolet];
4761[label="4.146.24.140;195pkt 195fpkt", shape=invtriangle, color=brown];
stat486[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.146.24.140:1026, *:137}[51.0204%]&lt;BR/&gt;{4.146.24.140:1034, *:137}[48.9796%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 1026: (33.506%)&lt;BR/&gt; 1034: (16.494%)&gt;];
}
994--1451[label="1;94pkt 94fpkt"];
994--3970[label="1;94pkt 94fpkt"];
994--4761[label="1;94pkt 94fpkt"];
1451--3970[label="1;94pkt 94fpkt"];
1451--4761[label="1;94pkt 94fpkt"];
3970--4761[label="1;195pkt 195fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="4.146.24.140" src_port="1026"/>
      <filter dst_port="137" src_ip="4.146.24.140" src_port="1034"/>
    </slice>
    <from sec="1041397949" usec="0"/>
    <to sec="1041398308" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_487{
style=filled;
color=gray75;
389[label="91.101.140.140s;295pkt 295fpkt", shape=rectangle, color=red];
995[label="91.101.140.140s;293pkt 293fpkt", shape=ellipse, color=green];
1452[label="91.101.140.140s;293pkt 293fpkt", shape=triangle, color=blue];
3972[label="91.101.140.140;317pkt 317fpkt", shape=pentagon, color=darkviolet];
4762[label="91.101.140.140;317pkt 317fpkt", shape=invtriangle, color=brown];
stat487[shape=component, label=&lt;Rules:&lt;BR/&gt;{91.101.140.140:1027, *:137}[57.8616%]&lt;BR/&gt;{91.101.140.140:1030, *:137}[42.1384%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 1027: (30.165%)&lt;BR/&gt; 1030: (19.835%)&gt;];
}
389--995[label="1;293pkt 293fpkt"];
389--1452[label="1;293pkt 293fpkt"];
389--3972[label="0.99661;294pkt 294fpkt"];
389--4762[label="0.99661;294pkt 294fpkt"];
995--1452[label="1;293pkt 293fpkt"];
995--3972[label="0.996587;292pkt 292fpkt"];
995--4762[label="0.996587;292pkt 292fpkt"];
1452--3972[label="0.996587;292pkt 292fpkt"];
1452--4762[label="0.996587;292pkt 292fpkt"];
3972--4762[label="1;317pkt 317fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="91.101.140.140" src_port="1027"/>
      <filter dst_port="137" src_ip="91.101.140.140" src_port="1030"/>
    </slice>
    <from sec="1041397243" usec="0"/>
    <to sec="1041398009" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_489{
style=filled;
color=gray75;
395[label="89.86.138.143s;254pkt 254fpkt", shape=rectangle, color=red];
1002[label="89.86.138.143s;254pkt 254fpkt", shape=ellipse, color=green];
1457[label="89.86.138.143s;254pkt 254fpkt", shape=triangle, color=blue];
3987[label="89.86.138.143;254pkt 254fpkt", shape=pentagon, color=darkviolet];
4768[label="89.86.138.143;253pkt 253fpkt", shape=invtriangle, color=brown];
stat489[shape=component, label=&lt;Rules:&lt;BR/&gt;{89.86.138.143:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
395--1002[label="1;254pkt 254fpkt"];
395--1457[label="1;254pkt 254fpkt"];
395--3987[label="1;254pkt 254fpkt"];
395--4768[label="1;253pkt 253fpkt"];
1002--1457[label="1;254pkt 254fpkt"];
1002--3987[label="1;254pkt 254fpkt"];
1002--4768[label="1;253pkt 253fpkt"];
1457--3987[label="1;254pkt 254fpkt"];
1457--4768[label="1;253pkt 253fpkt"];
3987--4768[label="1;253pkt 253fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="89.86.138.143" src_port="1028"/>
    </slice>
    <from sec="1041397904" usec="0"/>
    <to sec="1041397949" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_490{
style=filled;
color=gray75;
407[label="4.0.84.148s;137pkt 137fpkt", shape=rectangle, color=red];
1009[label="4.0.84.148s;108pkt 108fpkt", shape=ellipse, color=green];
1461[label="4.0.84.148s;108pkt 108fpkt", shape=triangle, color=blue];
stat490[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.0.84.148:64502, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 64502: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
407--1009[label="1;108pkt 108fpkt"];
407--1461[label="1;108pkt 108fpkt"];
1009--1461[label="1;108pkt 108fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="4.0.84.148" src_port="64502"/>
    </slice>
    <from sec="1041397768" usec="0"/>
    <to sec="1041397790" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.765089,1.92048,503,0 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_491{
style=filled;
color=gray75;
1021[label="70.162.58.153s;1pkt 1fpkt", shape=ellipse, color=green];
1467[label="70.162.58.153s;1pkt 1fpkt", shape=triangle, color=blue];
stat491[shape=component, label=&lt;Rules:&lt;BR/&gt;{144.52.218.153:80, 203.102.145.29:1905}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1905: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
1021--1467[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="203.102.145.29" dst_port="1905" src_ip="144.52.218.153" src_port="80"/>
    </slice>
    <from sec="1041398344" usec="0"/>
    <to sec="1041398359" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_492{
style=filled;
color=gray75;
429[label="217.79.171.156s;114pkt 114fpkt", shape=rectangle, color=red];
1027[label="217.79.171.156s;114pkt 114fpkt", shape=ellipse, color=green];
1471[label="217.79.171.156s;114pkt 114fpkt", shape=triangle, color=blue];
4041[label="217.79.171.156;158pkt 158fpkt", shape=pentagon, color=darkviolet];
stat492[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.79.171.156:1036, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1036: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
429--1027[label="1;114pkt 114fpkt"];
429--1471[label="1;114pkt 114fpkt"];
429--4041[label="1;114pkt 114fpkt"];
1027--1471[label="1;114pkt 114fpkt"];
1027--4041[label="1;114pkt 114fpkt"];
1471--4041[label="1;114pkt 114fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.79.171.156" src_port="1036"/>
    </slice>
    <from sec="1041398002" usec="0"/>
    <to sec="1041398028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_493{
style=filled;
color=gray75;
432[label="61.222.107.157s;99pkt 99fpkt", shape=rectangle, color=red];
1030[label="61.222.107.157s;99pkt 99fpkt", shape=ellipse, color=green];
1474[label="61.222.107.157s;99pkt 99fpkt", shape=triangle, color=blue];
stat493[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.222.107.157:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
432--1030[label="1;99pkt 99fpkt"];
432--1474[label="1;99pkt 99fpkt"];
1030--1474[label="1;99pkt 99fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.222.107.157" src_port="1025"/>
    </slice>
    <from sec="1041398219" usec="0"/>
    <to sec="1041398235" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_494{
style=filled;
color=gray75;
437[label="61.233.100.159s;229pkt 229fpkt", shape=rectangle, color=red];
1034[label="61.233.100.159s;229pkt 229fpkt", shape=ellipse, color=green];
1476[label="61.233.100.159s;229pkt 229fpkt", shape=triangle, color=blue];
4054[label="61.233.100.159;230pkt 230fpkt", shape=pentagon, color=darkviolet];
stat494[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.233.100.159:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
437--1034[label="1;229pkt 229fpkt"];
437--1476[label="1;229pkt 229fpkt"];
437--4054[label="0.995633;228pkt 228fpkt"];
1034--1476[label="1;229pkt 229fpkt"];
1034--4054[label="0.995633;228pkt 228fpkt"];
1476--4054[label="0.995633;228pkt 228fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.233.100.159" src_port="1029"/>
    </slice>
    <from sec="1041397870" usec="0"/>
    <to sec="1041397907" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_495{
style=filled;
color=gray75;
438[label="210.228.102.159s;231pkt 231fpkt", shape=rectangle, color=red];
1035[label="210.228.102.159s;149pkt 149fpkt", shape=ellipse, color=green];
1477[label="210.228.102.159s;149pkt 149fpkt", shape=triangle, color=blue];
4055[label="210.228.102.159;230pkt 230fpkt", shape=pentagon, color=darkviolet];
4804[label="210.228.102.159;231pkt 231fpkt", shape=invtriangle, color=brown];
stat495[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.228.102.159:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
438--1035[label="1;149pkt 149fpkt"];
438--1477[label="1;149pkt 149fpkt"];
438--4055[label="1;230pkt 230fpkt"];
438--4804[label="1;231pkt 231fpkt"];
1035--1477[label="1;149pkt 149fpkt"];
1035--4055[label="1;149pkt 149fpkt"];
1035--4804[label="1;149pkt 149fpkt"];
1477--4055[label="1;149pkt 149fpkt"];
1477--4804[label="1;149pkt 149fpkt"];
4055--4804[label="1;230pkt 230fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="210.228.102.159" src_port="1025"/>
    </slice>
    <from sec="1041398161" usec="0"/>
    <to sec="1041398197" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_496{
style=filled;
color=gray75;
441[label="212.94.3.161s;216pkt 216fpkt", shape=rectangle, color=red];
1038[label="212.94.3.161s;216pkt 216fpkt", shape=ellipse, color=green];
1479[label="212.94.3.161s;216pkt 216fpkt", shape=triangle, color=blue];
4061[label="212.94.3.161;240pkt 240fpkt", shape=pentagon, color=darkviolet];
stat496[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.94.3.161:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
441--1038[label="1;216pkt 216fpkt"];
441--1479[label="1;216pkt 216fpkt"];
441--4061[label="1;216pkt 216fpkt"];
1038--1479[label="1;216pkt 216fpkt"];
1038--4061[label="1;216pkt 216fpkt"];
1479--4061[label="1;216pkt 216fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="212.94.3.161" src_port="1025"/>
    </slice>
    <from sec="1041397877" usec="0"/>
    <to sec="1041397915" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695213,1.95262,002,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="61.142.100.162" src_port="1025"/>
      <from sec="1041398026" usec="0"/>
      <to sec="1041398038" usec="0"/>
    </slice>
    <from sec="1041398026" usec="0"/>
    <to sec="1041398038" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_498{
style=filled;
color=gray75;
454[label="61.202.164.168s;134pkt 134fpkt", shape=rectangle, color=red];
1048[label="61.202.164.168s;69pkt 69fpkt", shape=ellipse, color=green];
1487[label="61.202.164.168s;69pkt 69fpkt", shape=triangle, color=blue];
stat498[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.202.164.168:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
454--1048[label="1;69pkt 69fpkt"];
454--1487[label="1;69pkt 69fpkt"];
1048--1487[label="1;69pkt 69fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.202.164.168" src_port="1025"/>
    </slice>
    <from sec="1041397420" usec="0"/>
    <to sec="1041397442" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_499{
style=filled;
color=gray75;
463[label="70.129.36.171s;139pkt 139fpkt", shape=rectangle, color=red];
1053[label="70.129.36.171s;130pkt 130fpkt", shape=ellipse, color=green];
1489[label="70.129.36.171s;130pkt 130fpkt", shape=triangle, color=blue];
4105[label="70.129.36.171;139pkt 139fpkt", shape=pentagon, color=darkviolet];
stat499[shape=component, label=&lt;Rules:&lt;BR/&gt;{70.129.36.171:24239, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 24239: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
463--1053[label="1;130pkt 130fpkt"];
463--1489[label="1;130pkt 130fpkt"];
463--4105[label="1;139pkt 139fpkt"];
1053--1489[label="1;130pkt 130fpkt"];
1053--4105[label="1;130pkt 130fpkt"];
1489--4105[label="1;130pkt 130fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="70.129.36.171" src_port="24239"/>
    </slice>
    <from sec="1041397432" usec="0"/>
    <to sec="1041397454" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_500{
style=filled;
color=gray75;
471[label="217.135.8.176s;205pkt 205fpkt", shape=rectangle, color=red];
1061[label="217.135.8.176s;171pkt 171fpkt", shape=ellipse, color=green];
1494[label="217.135.8.176s;96pkt 96fpkt", shape=triangle, color=blue];
stat500[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.135.8.176:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
471--1061[label="1;171pkt 171fpkt"];
471--1494[label="1;96pkt 96fpkt"];
1061--1494[label="1;96pkt 96fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.135.8.176" src_port="1027"/>
    </slice>
    <from sec="1041398392" usec="0"/>
    <to sec="1041398430" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_501{
style=filled;
color=gray75;
483[label="88.58.222.182s;246pkt 246fpkt", shape=rectangle, color=red];
1070[label="88.58.222.182s;212pkt 212fpkt", shape=ellipse, color=green];
1500[label="88.58.222.182s;212pkt 212fpkt", shape=triangle, color=blue];
4142[label="88.58.222.182;256pkt 256fpkt", shape=pentagon, color=darkviolet];
stat501[shape=component, label=&lt;Rules:&lt;BR/&gt;{88.58.222.182:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
483--1070[label="1;212pkt 212fpkt"];
483--1500[label="1;212pkt 212fpkt"];
483--4142[label="1;246pkt 246fpkt"];
1070--1500[label="1;212pkt 212fpkt"];
1070--4142[label="1;212pkt 212fpkt"];
1500--4142[label="1;212pkt 212fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="88.58.222.182" src_port="1027"/>
    </slice>
    <from sec="1041397945" usec="0"/>
    <to sec="1041397964" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_502{
style=filled;
color=gray75;
492[label="195.96.130.188s;69pkt 69fpkt", shape=rectangle, color=red];
1078[label="195.96.130.188s;69pkt 69fpkt", shape=ellipse, color=green];
1506[label="195.96.130.188s;69pkt 69fpkt", shape=triangle, color=blue];
stat502[shape=component, label=&lt;Rules:&lt;BR/&gt;{195.96.130.188:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
492--1078[label="1;69pkt 69fpkt"];
492--1506[label="1;69pkt 69fpkt"];
1078--1506[label="1;69pkt 69fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="195.96.130.188" src_port="1026"/>
    </slice>
    <from sec="1041398375" usec="0"/>
    <to sec="1041398387" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.946667,1.87498,999,1 1 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_503{
style=filled;
color=gray75;
507[label="61.140.48.197s;1pkt 1fpkt", shape=rectangle, color=red];
1087[label="61.140.48.197s;1pkt 1fpkt", shape=ellipse, color=green];
1513[label="61.140.48.197s;1pkt 1fpkt", shape=triangle, color=blue];
1860[label="70.160.180.197;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat503[shape=component, label=&lt;Rules:&lt;BR/&gt;{70.160.180.197:412, 168.125.205.3:3452}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3452: (50%)&lt;BR/&gt; 412: (50%)&gt;];
}
507--1087[label="1;1pkt 1fpkt"];
507--1513[label="1;1pkt 1fpkt"];
507--1860[label="1;1pkt 1fpkt"];
507--1891[label="1;1pkt 1fpkt"];
507--2963[label="1;1pkt 1fpkt"];
507--3250[label="1;1pkt 1fpkt"];
1087--1513[label="1;1pkt 1fpkt"];
1087--1860[label="1;1pkt 1fpkt"];
1087--1891[label="1;1pkt 1fpkt"];
1087--2963[label="1;1pkt 1fpkt"];
1087--3250[label="1;1pkt 1fpkt"];
1513--1860[label="1;1pkt 1fpkt"];
1513--1891[label="1;1pkt 1fpkt"];
1513--2963[label="1;1pkt 1fpkt"];
1513--3250[label="1;1pkt 1fpkt"];
1860--1891[label="1;1pkt 1fpkt"];
1860--2963[label="1;1pkt 1fpkt"];
1860--3250[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="168.125.205.3" dst_port="3452" src_ip="70.160.180.197" src_port="412"/>
    </slice>
    <from sec="1041397201" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_504{
style=filled;
color=gray75;
511[label="61.136.182.199s;104pkt 104fpkt", shape=rectangle, color=red];
1089[label="61.136.182.199s;104pkt 104fpkt", shape=ellipse, color=green];
1515[label="61.136.182.199s;104pkt 104fpkt", shape=triangle, color=blue];
4197[label="61.136.182.199;130pkt 130fpkt", shape=pentagon, color=darkviolet];
stat504[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.136.182.199:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
511--1089[label="1;104pkt 104fpkt"];
511--1515[label="1;104pkt 104fpkt"];
511--4197[label="1;104pkt 104fpkt"];
1089--1515[label="1;104pkt 104fpkt"];
1089--4197[label="1;104pkt 104fpkt"];
1515--4197[label="1;104pkt 104fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.136.182.199" src_port="1028"/>
    </slice>
    <from sec="1041397371" usec="0"/>
    <to sec="1041397392" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_505{
style=filled;
color=gray75;
513[label="217.52.58.200s;228pkt 228fpkt", shape=rectangle, color=red];
1091[label="217.52.58.200s;228pkt 228fpkt", shape=ellipse, color=green];
1516[label="217.52.58.200s;228pkt 228fpkt", shape=triangle, color=blue];
4201[label="217.52.58.200;227pkt 227fpkt", shape=pentagon, color=darkviolet];
4886[label="217.52.58.200;228pkt 228fpkt", shape=invtriangle, color=brown];
stat505[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.52.58.200:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
513--1091[label="1;228pkt 228fpkt"];
513--1516[label="1;228pkt 228fpkt"];
513--4201[label="1;227pkt 227fpkt"];
513--4886[label="1;228pkt 228fpkt"];
1091--1516[label="1;228pkt 228fpkt"];
1091--4201[label="1;227pkt 227fpkt"];
1091--4886[label="1;228pkt 228fpkt"];
1516--4201[label="1;227pkt 227fpkt"];
1516--4886[label="1;228pkt 228fpkt"];
4201--4886[label="1;227pkt 227fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.52.58.200" src_port="1025"/>
    </slice>
    <from sec="1041397895" usec="0"/>
    <to sec="1041397932" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_506{
style=filled;
color=gray75;
515[label="217.128.45.202s;205pkt 205fpkt", shape=rectangle, color=red];
1092[label="217.128.45.202s;84pkt 84fpkt", shape=ellipse, color=green];
1517[label="217.128.45.202s;84pkt 84fpkt", shape=triangle, color=blue];
stat506[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.128.45.202:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
515--1092[label="1;84pkt 84fpkt"];
515--1517[label="1;84pkt 84fpkt"];
1092--1517[label="1;84pkt 84fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.128.45.202" src_port="1025"/>
    </slice>
    <from sec="1041398316" usec="0"/>
    <to sec="1041398358" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_507{
style=filled;
color=gray75;
517[label="218.203.85.203s;89pkt 89fpkt", shape=rectangle, color=red];
1094[label="218.203.85.203s;89pkt 89fpkt", shape=ellipse, color=green];
1519[label="218.203.85.203s;89pkt 89fpkt", shape=triangle, color=blue];
stat507[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.203.85.203:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
517--1094[label="1;89pkt 89fpkt"];
517--1519[label="1;89pkt 89fpkt"];
1094--1519[label="1;89pkt 89fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="218.203.85.203" src_port="1028"/>
    </slice>
    <from sec="1041398281" usec="0"/>
    <to sec="1041398295" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.77598,1.88018,002,0 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_508{
style=filled;
color=gray75;
1095[label="209.97.152.203s;73pkt 73fpkt", shape=ellipse, color=green];
1520[label="209.97.152.203s;73pkt 73fpkt", shape=triangle, color=blue];
4218[label="209.97.152.203;149pkt 149fpkt", shape=pentagon, color=darkviolet];
stat508[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.97.152.203:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
1095--1520[label="1;73pkt 73fpkt"];
1095--4218[label="0.986301;72pkt 72fpkt"];
1520--4218[label="0.986301;72pkt 72fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="209.97.152.203" src_port="1027"/>
    </slice>
    <from sec="1041398237" usec="0"/>
    <to sec="1041398260" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_509{
style=filled;
color=gray75;
520[label="62.126.149.204s;100pkt 100fpkt", shape=rectangle, color=red];
1097[label="62.126.149.204s;100pkt 100fpkt", shape=ellipse, color=green];
1521[label="62.126.149.204s;100pkt 100fpkt", shape=triangle, color=blue];
4220[label="62.126.149.204;138pkt 138fpkt", shape=pentagon, color=darkviolet];
stat509[shape=component, label=&lt;Rules:&lt;BR/&gt;{62.126.149.204:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
520--1097[label="1;100pkt 100fpkt"];
520--1521[label="1;100pkt 100fpkt"];
520--4220[label="1;100pkt 100fpkt"];
1097--1521[label="1;100pkt 100fpkt"];
1097--4220[label="1;100pkt 100fpkt"];
1521--4220[label="1;100pkt 100fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="62.126.149.204" src_port="1027"/>
    </slice>
    <from sec="1041397826" usec="0"/>
    <to sec="1041397848" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.765089,1.92048,002,0 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_510{
style=filled;
color=gray75;
1105[label="62.81.11.212s;153pkt 153fpkt", shape=ellipse, color=green];
1526[label="62.81.11.212s;70pkt 70fpkt", shape=triangle, color=blue];
stat510[shape=component, label=&lt;Rules:&lt;BR/&gt;{62.81.11.212:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
1105--1526[label="1;70pkt 70fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="62.81.11.212" src_port="1026"/>
    </slice>
    <from sec="1041398375" usec="0"/>
    <to sec="1041398407" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_511{
style=filled;
color=gray75;
542[label="61.74.245.218s;256pkt 256fpkt", shape=rectangle, color=red];
1113[label="61.74.245.218s;256pkt 256fpkt", shape=ellipse, color=green];
1531[label="61.74.245.218s;203pkt 203fpkt", shape=triangle, color=blue];
4283[label="61.74.245.218;256pkt 256fpkt", shape=pentagon, color=darkviolet];
4929[label="61.74.245.218;256pkt 256fpkt", shape=invtriangle, color=brown];
5252[label="61.74.245.218;256pkt 256fpkt", shape=invhouse, color=bisque];
stat511[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.74.245.218:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
542--1113[label="1;256pkt 256fpkt"];
542--1531[label="1;203pkt 203fpkt"];
542--3285[label="0.511719;131pkt 131fpkt"];
542--4283[label="1;256pkt 256fpkt"];
542--4929[label="1;256pkt 256fpkt"];
542--5252[label="1;256pkt 256fpkt"];
1113--1531[label="1;203pkt 203fpkt"];
1113--3285[label="0.511719;131pkt 131fpkt"];
1113--4283[label="1;256pkt 256fpkt"];
1113--4929[label="1;256pkt 256fpkt"];
1113--5252[label="1;256pkt 256fpkt"];
1531--3285[label="0.384236;78pkt 78fpkt"];
1531--4283[label="1;203pkt 203fpkt"];
1531--4929[label="1;203pkt 203fpkt"];
1531--5252[label="1;203pkt 203fpkt"];
4283--4929[label="1;256pkt 256fpkt"];
4283--5252[label="1;256pkt 256fpkt"];
4929--5252[label="1;256pkt 256fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.74.245.218" src_port="1028"/>
    </slice>
    <from sec="1041398757" usec="0"/>
    <to sec="1041398799" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_512{
style=filled;
color=gray75;
548[label="202.87.210.220s;243pkt 243fpkt", shape=rectangle, color=red];
1118[label="202.87.210.220s;243pkt 243fpkt", shape=ellipse, color=green];
1536[label="202.87.210.220s;96pkt 96fpkt", shape=triangle, color=blue];
4296[label="202.87.210.220;243pkt 243fpkt", shape=pentagon, color=darkviolet];
4936[label="202.87.210.220;242pkt 242fpkt", shape=invtriangle, color=brown];
5257[label="202.87.210.220;242pkt 242fpkt", shape=invhouse, color=bisque];
stat512[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.87.210.220:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
548--1118[label="1;243pkt 243fpkt"];
548--1536[label="1;96pkt 96fpkt"];
548--4296[label="1;243pkt 243fpkt"];
548--4936[label="1;242pkt 242fpkt"];
548--5257[label="1;242pkt 242fpkt"];
1118--1536[label="1;96pkt 96fpkt"];
1118--4296[label="1;243pkt 243fpkt"];
1118--4936[label="1;242pkt 242fpkt"];
1118--5257[label="1;242pkt 242fpkt"];
1536--4296[label="1;96pkt 96fpkt"];
1536--4936[label="0.989583;95pkt 95fpkt"];
1536--5257[label="0.989583;95pkt 95fpkt"];
4296--4936[label="1;242pkt 242fpkt"];
4296--5257[label="1;242pkt 242fpkt"];
4936--5257[label="1;242pkt 242fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="202.87.210.220" src_port="1026"/>
    </slice>
    <from sec="1041397304" usec="0"/>
    <to sec="1041397343" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_513{
style=filled;
color=gray75;
551[label="218.213.155.222s;104pkt 104fpkt", shape=rectangle, color=red];
1120[label="218.213.155.222s;104pkt 104fpkt", shape=ellipse, color=green];
1538[label="218.213.155.222s;104pkt 104fpkt", shape=triangle, color=blue];
4301[label="218.213.155.222;124pkt 124fpkt", shape=pentagon, color=darkviolet];
4941[label="218.213.155.222;124pkt 124fpkt", shape=invtriangle, color=brown];
5258[label="218.213.155.222;124pkt 124fpkt", shape=invhouse, color=bisque];
stat513[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.213.155.222:1030, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1030: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
551--1120[label="1;104pkt 104fpkt"];
551--1538[label="1;104pkt 104fpkt"];
551--4301[label="1;104pkt 104fpkt"];
551--4941[label="1;104pkt 104fpkt"];
551--5258[label="1;104pkt 104fpkt"];
1120--1538[label="1;104pkt 104fpkt"];
1120--4301[label="1;104pkt 104fpkt"];
1120--4941[label="1;104pkt 104fpkt"];
1120--5258[label="1;104pkt 104fpkt"];
1538--4301[label="1;104pkt 104fpkt"];
1538--4941[label="1;104pkt 104fpkt"];
1538--5258[label="1;104pkt 104fpkt"];
4301--4941[label="1;124pkt 124fpkt"];
4301--5258[label="1;124pkt 124fpkt"];
4941--5258[label="1;124pkt 124fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="218.213.155.222" src_port="1030"/>
    </slice>
    <from sec="1041398341" usec="0"/>
    <to sec="1041398361" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_514{
style=filled;
color=gray75;
556[label="91.115.45.225s;206pkt 206fpkt", shape=rectangle, color=red];
1123[label="91.115.45.225s;206pkt 206fpkt", shape=ellipse, color=green];
1541[label="91.115.45.225s;206pkt 206fpkt", shape=triangle, color=blue];
stat514[shape=component, label=&lt;Rules:&lt;BR/&gt;{91.115.45.225:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
556--1123[label="1;206pkt 206fpkt"];
556--1541[label="1;206pkt 206fpkt"];
1123--1541[label="1;206pkt 206fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="91.115.45.225" src_port="1026"/>
    </slice>
    <from sec="1041398392" usec="0"/>
    <to sec="1041398423" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_515{
style=filled;
color=gray75;
560[label="61.110.66.227s;207pkt 207fpkt", shape=rectangle, color=red];
1126[label="61.110.66.227s;175pkt 175fpkt", shape=ellipse, color=green];
1543[label="61.110.66.227s;175pkt 175fpkt", shape=triangle, color=blue];
4312[label="61.110.66.227;244pkt 244fpkt", shape=pentagon, color=darkviolet];
4945[label="61.110.66.227;244pkt 244fpkt", shape=invtriangle, color=brown];
5263[label="61.110.66.227;244pkt 244fpkt", shape=invhouse, color=bisque];
stat515[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.110.66.227:1033, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1033: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
560--1126[label="1;175pkt 175fpkt"];
560--1543[label="1;175pkt 175fpkt"];
560--4312[label="1;207pkt 207fpkt"];
560--4945[label="1;207pkt 207fpkt"];
560--5263[label="1;207pkt 207fpkt"];
1126--1543[label="1;175pkt 175fpkt"];
1126--4312[label="1;175pkt 175fpkt"];
1126--4945[label="1;175pkt 175fpkt"];
1126--5263[label="1;175pkt 175fpkt"];
1543--4312[label="1;175pkt 175fpkt"];
1543--4945[label="1;175pkt 175fpkt"];
1543--5263[label="1;175pkt 175fpkt"];
4312--4945[label="1;244pkt 244fpkt"];
4312--5263[label="1;244pkt 244fpkt"];
4945--5263[label="1;244pkt 244fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.110.66.227" src_port="1033"/>
    </slice>
    <from sec="1041397464" usec="0"/>
    <to sec="1041397502" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_516{
style=filled;
color=gray75;
566[label="4.207.212.229s;133pkt 133fpkt", shape=rectangle, color=red];
1131[label="4.207.212.229s;133pkt 133fpkt", shape=ellipse, color=green];
1544[label="4.207.212.229s;107pkt 107fpkt", shape=triangle, color=blue];
4325[label="4.207.212.229;144pkt 144fpkt", shape=pentagon, color=darkviolet];
4954[label="4.207.212.229;144pkt 144fpkt", shape=invtriangle, color=brown];
5268[label="4.207.212.229;143pkt 143fpkt", shape=invhouse, color=bisque];
stat516[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.207.212.229:21027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
566--1131[label="1;133pkt 133fpkt"];
566--1544[label="1;107pkt 107fpkt"];
566--4325[label="1;133pkt 133fpkt"];
566--4954[label="1;133pkt 133fpkt"];
566--5268[label="0.992481;132pkt 132fpkt"];
1131--1544[label="1;107pkt 107fpkt"];
1131--4325[label="1;133pkt 133fpkt"];
1131--4954[label="1;133pkt 133fpkt"];
1131--5268[label="0.992481;132pkt 132fpkt"];
1544--4325[label="1;107pkt 107fpkt"];
1544--4954[label="1;107pkt 107fpkt"];
1544--5268[label="0.990654;106pkt 106fpkt"];
4325--4954[label="1;144pkt 144fpkt"];
4325--5268[label="1;143pkt 143fpkt"];
4954--5268[label="1;143pkt 143fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="4.207.212.229" src_port="21027"/>
    </slice>
    <from sec="1041397559" usec="0"/>
    <to sec="1041397581" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_517{
style=filled;
color=gray75;
567[label="61.214.181.230s;198pkt 198fpkt", shape=rectangle, color=red];
1132[label="61.214.181.230s;198pkt 198fpkt", shape=ellipse, color=green];
1545[label="61.214.181.230s;81pkt 81fpkt", shape=triangle, color=blue];
4328[label="61.214.181.230;218pkt 218fpkt", shape=pentagon, color=darkviolet];
stat517[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.214.181.230:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
567--1132[label="1;198pkt 198fpkt"];
567--1545[label="1;81pkt 81fpkt"];
567--4328[label="1;198pkt 198fpkt"];
1132--1545[label="1;81pkt 81fpkt"];
1132--4328[label="1;198pkt 198fpkt"];
1545--4328[label="1;81pkt 81fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.214.181.230" src_port="1026"/>
    </slice>
    <from sec="1041397427" usec="0"/>
    <to sec="1041397466" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_518{
style=filled;
color=gray75;
570[label="61.164.5.233s;147pkt 147fpkt", shape=rectangle, color=red];
1135[label="61.164.5.233s;94pkt 94fpkt", shape=ellipse, color=green];
1547[label="61.164.5.233s;94pkt 94fpkt", shape=triangle, color=blue];
stat518[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.164.5.233:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
570--1135[label="1;94pkt 94fpkt"];
570--1547[label="1;94pkt 94fpkt"];
1135--1547[label="1;94pkt 94fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.164.5.233" src_port="1025"/>
    </slice>
    <from sec="1041397460" usec="0"/>
    <to sec="1041397483" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_519{
style=filled;
color=gray75;
575[label="218.63.157.234s;148pkt 148fpkt", shape=rectangle, color=red];
1140[label="218.63.157.234s;148pkt 148fpkt", shape=ellipse, color=green];
1551[label="218.63.157.234s;148pkt 148fpkt", shape=triangle, color=blue];
stat519[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.63.157.234:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
575--1140[label="1;148pkt 148fpkt"];
575--1551[label="1;148pkt 148fpkt"];
1140--1551[label="1;148pkt 148fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="218.63.157.234" src_port="1028"/>
    </slice>
    <from sec="1041397956" usec="0"/>
    <to sec="1041397978" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_520{
style=filled;
color=gray75;
584[label="61.165.56.238s;249pkt 249fpkt", shape=rectangle, color=red];
1148[label="61.165.56.238s;249pkt 249fpkt", shape=ellipse, color=green];
1557[label="61.165.56.238s;129pkt 129fpkt", shape=triangle, color=blue];
stat520[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.165.56.238:63009, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 63009: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
584--1148[label="1;249pkt 249fpkt"];
584--1557[label="1;129pkt 129fpkt"];
1148--1557[label="1;129pkt 129fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.165.56.238" src_port="63009"/>
    </slice>
    <from sec="1041398132" usec="0"/>
    <to sec="1041398174" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_521{
style=filled;
color=gray75;
586[label="217.22.170.238s;226pkt 226fpkt", shape=rectangle, color=red];
1150[label="217.22.170.238s;188pkt 188fpkt", shape=ellipse, color=green];
1559[label="217.22.170.238s;160pkt 160fpkt", shape=triangle, color=blue];
4354[label="217.22.170.238;249pkt 249fpkt", shape=pentagon, color=darkviolet];
stat521[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.22.170.238:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
586--1150[label="1;188pkt 188fpkt"];
586--1559[label="1;160pkt 160fpkt"];
586--4354[label="1;226pkt 226fpkt"];
1150--1559[label="1;160pkt 160fpkt"];
1150--4354[label="1;188pkt 188fpkt"];
1559--4354[label="1;160pkt 160fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.22.170.238" src_port="1028"/>
    </slice>
    <from sec="1041397463" usec="0"/>
    <to sec="1041397515" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_522{
style=filled;
color=gray75;
588[label="90.16.167.239s;183pkt 183fpkt", shape=rectangle, color=red];
1152[label="90.16.167.239s;163pkt 163fpkt", shape=ellipse, color=green];
1560[label="90.16.167.239s;163pkt 163fpkt", shape=triangle, color=blue];
stat522[shape=component, label=&lt;Rules:&lt;BR/&gt;{90.16.167.239:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
588--1152[label="1;163pkt 163fpkt"];
588--1560[label="1;163pkt 163fpkt"];
1152--1560[label="1;163pkt 163fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="90.16.167.239" src_port="1028"/>
    </slice>
    <from sec="1041397680" usec="0"/>
    <to sec="1041397709" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695213,1.95262,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="203.59.21.3" dst_port="137" proto="udp" src_ip="91.33.129.240" src_port="1027"/>
      <filter dst_ip="203.59.21.3" dst_port="53" proto="udp" src_ip="91.33.129.240" src_port="1027"/>
      <from sec="1041398648" usec="0"/>
      <to sec="1041398664" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="203.59.21.3" dst_port="137" proto="udp" src_ip="218.74.197.240" src_port="1027"/>
      <filter dst_ip="203.59.21.3" dst_port="53" proto="udp" src_ip="218.74.197.240" src_port="1027"/>
      <from sec="1041398649" usec="0"/>
      <to sec="1041398656" usec="0"/>
    </slice>
    <from sec="1041398648" usec="0"/>
    <to sec="1041398666" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_524{
style=filled;
color=gray75;
592[label="88.4.178.240s;75pkt 75fpkt", shape=rectangle, color=red];
1155[label="88.4.178.240s;75pkt 75fpkt", shape=ellipse, color=green];
1563[label="88.4.178.240s;75pkt 75fpkt", shape=triangle, color=blue];
stat524[shape=component, label=&lt;Rules:&lt;BR/&gt;{88.4.178.240:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
592--1155[label="1;75pkt 75fpkt"];
592--1563[label="1;75pkt 75fpkt"];
1155--1563[label="1;75pkt 75fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="88.4.178.240" src_port="1025"/>
    </slice>
    <from sec="1041398534" usec="0"/>
    <to sec="1041398548" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.04191,1.81684,999,1 1 1 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_525{
style=filled;
color=gray75;
641[label="89.70.37.249s;1pkt 1fpkt", shape=rectangle, color=red];
1191[label="89.70.37.249s;1pkt 1fpkt", shape=ellipse, color=green];
1568[label="89.96.109.249s;1pkt 1fpkt", shape=triangle, color=blue];
2065[label="203.11.238.125;d;234pkt 234fpkt", shape=diamond, color=yellow];
3574[label="4.83.18.52;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4548[label="4.83.18.52;1pkt 1fpkt", shape=invtriangle, color=brown];
stat525[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 203.11.238.125:41170}[95.2991%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 41170: (47.6987%)&lt;BR/&gt; 0: (4.60251%)&lt;BR/&gt; 3078: (0.83682%)&lt;BR/&gt; 2308: (0.627615%)&lt;BR/&gt; 2456: (0.41841%)&gt;];
}
641--1191[label="1;1pkt 1fpkt"];
641--1568[label="1;1pkt 1fpkt"];
641--2065[label="1;1pkt 1fpkt"];
1191--1568[label="1;1pkt 1fpkt"];
1191--2065[label="1;1pkt 1fpkt"];
1568--2065[label="1;1pkt 1fpkt"];
2065--3574[label="1;1pkt 1fpkt"];
2065--4548[label="1;1pkt 1fpkt"];
3574--4548[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="203.11.238.125" dst_port="41170"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398783" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_526{
style=filled;
color=gray75;
609[label="171.205.211.255s;249pkt 249fpkt", shape=rectangle, color=red];
1165[label="171.205.211.255s;249pkt 249fpkt", shape=ellipse, color=green];
1570[label="171.205.211.255s;249pkt 249fpkt", shape=triangle, color=blue];
4399[label="171.205.211.255;252pkt 252fpkt", shape=pentagon, color=darkviolet];
4991[label="171.205.211.255;252pkt 252fpkt", shape=invtriangle, color=brown];
5293[label="171.205.211.255;252pkt 252fpkt", shape=invhouse, color=bisque];
stat526[shape=component, label=&lt;Rules:&lt;BR/&gt;{171.205.211.255:1039, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1039: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
609--1165[label="1;249pkt 249fpkt"];
609--1570[label="1;249pkt 249fpkt"];
609--4399[label="1;249pkt 249fpkt"];
609--4991[label="1;249pkt 249fpkt"];
609--5293[label="1;249pkt 249fpkt"];
1165--1570[label="1;249pkt 249fpkt"];
1165--4399[label="1;249pkt 249fpkt"];
1165--4991[label="1;249pkt 249fpkt"];
1165--5293[label="1;249pkt 249fpkt"];
1570--4399[label="1;249pkt 249fpkt"];
1570--4991[label="1;249pkt 249fpkt"];
1570--5293[label="1;249pkt 249fpkt"];
4399--4991[label="1;252pkt 252fpkt"];
4399--5293[label="1;252pkt 252fpkt"];
4991--5293[label="1;252pkt 252fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="171.205.211.255" src_port="1039"/>
    </slice>
    <from sec="1041397372" usec="0"/>
    <to sec="1041397411" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.955492,1.83368,010,1 1 1 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_527{
style=filled;
color=gray75;
612[label="88.32.240.18s;254pkt 254fpkt", shape=rectangle, color=red];
1167[label="88.32.240.18s;254pkt 254fpkt", shape=ellipse, color=green];
1571[label="88.32.240.18s;254pkt 254fpkt", shape=triangle, color=blue];
2676[label="88.32.240.18;s;254pkt 254fpkt", shape=diamond, color=yellow];
3419[label="88.32.240.18;254pkt 254fpkt", shape=pentagon, color=darkviolet];
stat527[shape=component, label=&lt;Rules:&lt;BR/&gt;{88.32.240.18:*, *:1433}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1433: (50%)&lt;BR/&gt; 1712: (0.19685%)&lt;BR/&gt; 1711: (0.19685%)&lt;BR/&gt; 1710: (0.19685%)&lt;BR/&gt; 1709: (0.19685%)&gt;];
}
612--1167[label="1;254pkt 254fpkt"];
612--1571[label="1;254pkt 254fpkt"];
612--2676[label="1;254pkt 254fpkt"];
612--3419[label="1;254pkt 254fpkt"];
1167--1571[label="1;254pkt 254fpkt"];
1167--2676[label="1;254pkt 254fpkt"];
1167--3419[label="1;254pkt 254fpkt"];
1571--2676[label="1;254pkt 254fpkt"];
1571--3419[label="1;254pkt 254fpkt"];
2676--3419[label="1;254pkt 254fpkt"];
</description>
    <slice>
      <filter dst_port="1433" src_ip="88.32.240.18"/>
    </slice>
    <from sec="1041398580" usec="0"/>
    <to sec="1041398618" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_528{
style=filled;
color=gray75;
624[label="213.227.253.105s;172pkt 172fpkt", shape=rectangle, color=red];
1179[label="213.227.253.105s;172pkt 172fpkt", shape=ellipse, color=green];
1581[label="213.227.253.105s;113pkt 113fpkt", shape=triangle, color=blue];
3794[label="213.227.253.105;191pkt 191fpkt", shape=pentagon, color=darkviolet];
4659[label="213.227.253.105;191pkt 191fpkt", shape=invtriangle, color=brown];
5122[label="213.227.253.105;190pkt 190fpkt", shape=invhouse, color=bisque];
stat528[shape=component, label=&lt;Rules:&lt;BR/&gt;{213.227.253.105:*, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 59637: (0.291545%)&lt;BR/&gt; 59635: (0.291545%)&lt;BR/&gt; 59633: (0.291545%)&lt;BR/&gt; 59631: (0.291545%)&gt;];
}
624--1179[label="1;172pkt 172fpkt"];
624--1581[label="1;113pkt 113fpkt"];
624--3794[label="1;172pkt 172fpkt"];
624--4659[label="1;172pkt 172fpkt"];
624--5122[label="1;172pkt 172fpkt"];
1179--1581[label="1;113pkt 113fpkt"];
1179--3794[label="1;172pkt 172fpkt"];
1179--4659[label="1;172pkt 172fpkt"];
1179--5122[label="1;172pkt 172fpkt"];
1581--3794[label="1;113pkt 113fpkt"];
1581--4659[label="1;113pkt 113fpkt"];
1581--5122[label="1;113pkt 113fpkt"];
3794--4659[label="1;191pkt 191fpkt"];
3794--5122[label="1;190pkt 190fpkt"];
4659--5122[label="1;190pkt 190fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="213.227.253.105"/>
    </slice>
    <from sec="1041398355" usec="0"/>
    <to sec="1041398394" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_529{
style=filled;
color=gray75;
627[label="203.6.80.150s;197pkt 197fpkt", shape=rectangle, color=red];
1181[label="203.6.80.150s;92pkt 92fpkt", shape=ellipse, color=green];
1582[label="203.6.80.150s;92pkt 92fpkt", shape=triangle, color=blue];
4013[label="203.6.80.150;196pkt 196fpkt", shape=pentagon, color=darkviolet];
stat529[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.6.80.150:*, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 37472: (0.34662%)&lt;BR/&gt; 37471: (0.34662%)&lt;BR/&gt; 37470: (0.34662%)&lt;BR/&gt; 37469: (0.34662%)&gt;];
}
627--1181[label="1;92pkt 92fpkt"];
627--1582[label="1;92pkt 92fpkt"];
627--4013[label="1;196pkt 196fpkt"];
1181--1582[label="1;92pkt 92fpkt"];
1181--4013[label="1;92pkt 92fpkt"];
1582--4013[label="1;92pkt 92fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="203.6.80.150"/>
    </slice>
    <from sec="1041397444" usec="0"/>
    <to sec="1041397483" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695213,1.95262,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="61.242.73.168" src_port="6257"/>
      <filter dst_port="6257" proto="udp" src_ip="61.242.73.168" src_port="6257"/>
      <from sec="1041398585" usec="0"/>
      <to sec="1041398599" usec="0"/>
    </slice>
    <from sec="1041398585" usec="0"/>
    <to sec="1041398599" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,020,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_531{
style=filled;
color=gray75;
675[label="89.84.193.37d;140pkt 140fpkt", shape=rectangle, color=red];
1218[label="89.84.193.37d;140pkt 140fpkt", shape=ellipse, color=green];
1589[label="89.84.193.37d;72pkt 72fpkt", shape=triangle, color=blue];
stat531[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 89.84.193.37:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
675--1218[label="1;140pkt 140fpkt"];
675--1589[label="1;72pkt 72fpkt"];
1218--1589[label="1;72pkt 72fpkt"];
</description>
    <slice>
      <filter dst_ip="89.84.193.37"/>
    </slice>
    <from sec="1041398163" usec="0"/>
    <to sec="1041398189" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,020,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_532{
style=filled;
color=gray75;
681[label="216.241.145.108d;242pkt 242fpkt", shape=rectangle, color=red];
1200[label="216.241.145.108d;201pkt 201fpkt", shape=ellipse, color=green];
1594[label="216.241.145.108d;201pkt 201fpkt", shape=triangle, color=blue];
stat532[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 216.241.145.108:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
681--1200[label="1;201pkt 201fpkt"];
681--1594[label="1;201pkt 201fpkt"];
1200--1594[label="1;201pkt 201fpkt"];
</description>
    <slice>
      <filter dst_ip="216.241.145.108"/>
    </slice>
    <from sec="1041397707" usec="0"/>
    <to sec="1041397749" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.17115,1.93992,999,0 1 1 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_534{
style=filled;
color=gray75;
1204[label="210.218.28.151d;1pkt 1fpkt", shape=ellipse, color=green];
1597[label="210.218.28.151d;1pkt 1fpkt", shape=triangle, color=blue];
2422[label="4.18.31.73;s;1pkt 1fpkt", shape=diamond, color=yellow];
2423[label="136.234.32.151;d;1pkt 1fpkt", shape=diamond, color=yellow];
3052[label="136.234.32.151;d;1pkt 1fpkt", shape=hexagon, color=black];
stat534[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.18.31.73:6699, 136.234.32.151:1703}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (50%)&lt;BR/&gt; 1703: (50%)&gt;];
}
1204--1597[label="1;1pkt 1fpkt"];
1204--2422[label="1;1pkt 1fpkt"];
1204--2423[label="1;1pkt 1fpkt"];
1204--3052[label="1;1pkt 1fpkt"];
1597--2422[label="1;1pkt 1fpkt"];
1597--2423[label="1;1pkt 1fpkt"];
1597--3052[label="1;1pkt 1fpkt"];
2422--2423[label="1;1pkt 1fpkt"];
2422--3052[label="1;1pkt 1fpkt"];
2423--3052[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="136.234.32.151" dst_port="1703" src_ip="4.18.31.73" src_port="6699"/>
    </slice>
    <from sec="1041397202" usec="0"/>
    <to sec="1041398743" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03944,1.94366,999,0 1 1 0 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_535{
style=filled;
color=gray75;
1209[label="217.128.45.202d;2pkt 2fpkt", shape=ellipse, color=green];
1598[label="217.128.45.202d;2pkt 2fpkt", shape=triangle, color=blue];
3122[label="203.59.21.25;s;349pkt 349fpkt", shape=hexagon, color=black];
stat535[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.59.21.25:53, *:53}[22.5714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (60.6232%)&lt;BR/&gt; 1024: (1.41643%)&lt;BR/&gt; 0: (1.13314%)&lt;BR/&gt; 32768: (0.849858%)&lt;BR/&gt; 49455: (0.708215%)&gt;];
}
1209--1598[label="1;2pkt 2fpkt"];
1209--1639[label="0.5;1pkt 1fpkt"];
1209--2419[label="0.5;1pkt 1fpkt"];
1209--3122[label="0.5;1pkt 1fpkt"];
1598--1639[label="0.5;1pkt 1fpkt"];
1598--2419[label="0.5;1pkt 1fpkt"];
1598--3122[label="0.5;1pkt 1fpkt"];
3122--3274[label="0.00286533;1pkt 1fpkt"];
3122--3278[label="0.0143266;5pkt 5fpkt"];
3122--3282[label="0.0114613;4pkt 4fpkt"];
3122--3288[label="0.00286533;1pkt 1fpkt"];
3122--3293[label="0.0143266;5pkt 5fpkt"];
3122--3296[label="0.0114613;4pkt 4fpkt"];
3122--3297[label="0.00286533;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="53" src_ip="203.59.21.25" src_port="53"/>
    </slice>
    <from sec="1041397201" usec="0"/>
    <to sec="1041398747" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,020,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_536{
style=filled;
color=gray75;
663[label="200.235.83.215d;213pkt 213fpkt", shape=rectangle, color=red];
1210[label="200.235.83.215d;158pkt 158fpkt", shape=ellipse, color=green];
1599[label="200.235.83.215d;75pkt 75fpkt", shape=triangle, color=blue];
stat536[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 200.235.83.215:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
663--1210[label="1;158pkt 158fpkt"];
663--1599[label="1;75pkt 75fpkt"];
1210--1599[label="1;75pkt 75fpkt"];
</description>
    <slice>
      <filter dst_ip="200.235.83.215"/>
    </slice>
    <from sec="1041397596" usec="0"/>
    <to sec="1041397636" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695213,1.95262,020,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="202.37.177.64" proto="icmp"/>
      <filter dst_ip="202.37.177.64" proto="icmp"/>
      <filter dst_ip="202.37.177.64" proto="icmp"/>
      <filter dst_ip="202.37.177.64" proto="icmp"/>
      <from sec="1041398189" usec="0"/>
      <to sec="1041398205" usec="0"/>
    </slice>
    <from sec="1041398189" usec="0"/>
    <to sec="1041398205" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.777835,1.87885,020,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_538{
style=filled;
color=gray75;
658[label="61.141.57.190d;198pkt 198fpkt", shape=rectangle, color=red];
1206[label="61.141.57.190d;198pkt 198fpkt", shape=ellipse, color=green];
1612[label="61.141.57.190d;113pkt 113fpkt", shape=triangle, color=blue];
stat538[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 61.141.57.190:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
658--1206[label="1;198pkt 198fpkt"];
658--1612[label="1;113pkt 113fpkt"];
1206--1612[label="1;113pkt 113fpkt"];
</description>
    <slice>
      <filter dst_ip="61.141.57.190"/>
    </slice>
    <from sec="1041397218" usec="0"/>
    <to sec="1041397248" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757634,1.96858,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_543{
style=filled;
color=gray75;
1678[label="148.155.246.158;d;2pkt 2fpkt", shape=diamond, color=yellow];
1681[label="205.65.249.212;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat543[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.65.18.184:1863, 148.155.246.158:3267}[50%]&lt;BR/&gt;{205.65.249.212:80, 148.155.246.158:3167}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3167: (33.3333%)&lt;BR/&gt; 80: (33.3333%)&lt;BR/&gt; 3267: (16.6667%)&lt;BR/&gt; 1863: (16.6667%)&gt;];
}
1678--1681[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="148.155.246.158" dst_port="3167" src_ip="205.65.249.212" src_port="80"/>
      <filter dst_ip="148.155.246.158" dst_port="3267" src_ip="205.65.18.184" src_port="1863"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.770504,1.92799,999,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_544{
style=filled;
color=gray75;
29[label="203.59.18.72s;1pkt 1fpkt", shape=rectangle, color=red];
1673[label="219.40.55.204;d;219pkt 219fpkt", shape=diamond, color=yellow];
1675[label="203.59.18.72;s;332pkt 332fpkt", shape=diamond, color=yellow];
1687[label="193.168.124.150;d;3pkt 3fpkt", shape=diamond, color=yellow];
stat544[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.59.18.72:*, 219.40.55.204:*}[65.9639%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (5.85586%)&lt;BR/&gt; 21: (1.17117%)&lt;BR/&gt; 20: (1.08108%)&lt;BR/&gt; 0: (0.540541%)&lt;BR/&gt; 65534: (0.27027%)&gt;];
}
29--1675[label="1;1pkt 1fpkt"];
29--1687[label="1;1pkt 1fpkt"];
1673--1675[label="1;219pkt 219fpkt"];
1675--1687[label="1;3pkt 3fpkt"];
1675--1722[label="1;4pkt 4fpkt"];
1675--1752[label="1;27pkt 27fpkt"];
1675--2821[label="1;26pkt 26fpkt"];
1675--3072[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="219.40.55.204" src_ip="203.59.18.72"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.04205,1.95237,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_545{
style=filled;
color=gray75;
1688[label="48.7.139.8;d;162pkt 162fpkt", shape=diamond, color=yellow];
1689[label="48.7.139.8;s;162pkt 162fpkt", shape=diamond, color=yellow];
2740[label="48.7.139.8;s;110pkt 110fpkt", shape=hexagon, color=black];
3149[label="48.7.139.8;d;153pkt 153fpkt", shape=hexagon, color=black];
3360[label="48.7.139.8;165pkt 165fpkt", shape=pentagon, color=darkviolet];
stat545[shape=component, label=&lt;Rules:&lt;BR/&gt;{48.7.139.8:13364, 48.7.139.8:*}[93.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 13364: (46.875%)&lt;BR/&gt; 0: (2.99202%)&lt;BR/&gt; 13392: (0.99734%)&lt;BR/&gt; 80: (0.99734%)&lt;BR/&gt; 13556: (0.664894%)&gt;];
}
1688--1689[label="1;162pkt 162fpkt"];
1688--2740[label="1;110pkt 110fpkt"];
1688--3149[label="1;153pkt 153fpkt"];
1688--3279[label="0.0123457;2pkt 2fpkt"];
1688--3283[label="0.00617284;1pkt 1fpkt"];
1688--3284[label="0.00617284;1pkt 1fpkt"];
1688--3294[label="0.0123457;2pkt 2fpkt"];
1688--3360[label="1;162pkt 162fpkt"];
1689--2740[label="1;110pkt 110fpkt"];
1689--3149[label="1;153pkt 153fpkt"];
1689--3279[label="0.0123457;2pkt 2fpkt"];
1689--3283[label="0.00617284;1pkt 1fpkt"];
1689--3284[label="0.00617284;1pkt 1fpkt"];
1689--3294[label="0.0123457;2pkt 2fpkt"];
1689--3360[label="1;162pkt 162fpkt"];
2740--3149[label="1;110pkt 110fpkt"];
2740--3279[label="0.0181818;2pkt 2fpkt"];
2740--3283[label="0.00909091;1pkt 1fpkt"];
2740--3284[label="0.00909091;1pkt 1fpkt"];
2740--3294[label="0.0181818;2pkt 2fpkt"];
2740--3360[label="1;110pkt 110fpkt"];
3149--3279[label="0.0130719;2pkt 2fpkt"];
3149--3283[label="0.00653595;1pkt 1fpkt"];
3149--3284[label="0.00653595;1pkt 1fpkt"];
3149--3294[label="0.0130719;2pkt 2fpkt"];
3149--3360[label="1;153pkt 153fpkt"];
</description>
    <slice>
      <filter dst_ip="48.7.139.8" src_ip="48.7.139.8" src_port="13364"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.01054,2.00446,503,0 0 0 1 0 0 0 0 0 0 0 1 ">
    <description>subgraph cluster_546{
style=filled;
color=gray75;
2389[label="148.155.54.129;d;136pkt 136fpkt", shape=diamond, color=yellow];
5136[label="218.211.226.114;29pkt 29fpkt", shape=invhouse, color=bisque];
stat546[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.211.245.245:80, 148.155.54.129:*}[42.5676%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 39541: (0.606061%)&lt;BR/&gt; 39540: (0.606061%)&lt;BR/&gt; 39539: (0.606061%)&lt;BR/&gt; 39538: (0.606061%)&gt;];
}
2389--3169[label="1;109pkt 109fpkt"];
2389--3823[label="0.184211;7pkt 7fpkt"];
2389--3841[label="0.586207;17pkt 17fpkt"];
2389--4671[label="0.189189;7pkt 7fpkt"];
2389--4685[label="0.586207;17pkt 17fpkt"];
2389--4984[label="0.00884956;1pkt 1fpkt"];
2389--5128[label="0.184211;7pkt 7fpkt"];
2389--5136[label="0.586207;17pkt 17fpkt"];
</description>
    <slice>
      <filter dst_ip="148.155.54.129" src_ip="218.211.245.245" src_port="80"/>
    </slice>
    <from sec="1041397245" usec="0"/>
    <to sec="1041398801" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.16765,1.90283,999,1 1 0 1 1 0 0 0 0 0 1 0 ">
    <description>subgraph cluster_547{
style=filled;
color=gray75;
2[label="168.125.205.3s;2pkt 2fpkt", shape=rectangle, color=red];
656[label="91.85.195.162d;1pkt 1fpkt", shape=rectangle, color=red];
702[label="168.125.205.3s;2pkt 2fpkt", shape=ellipse, color=green];
1660[label="168.125.205.3;s;1335pkt 1335fpkt", shape=diamond, color=yellow];
1702[label="70.167.197.136;d;26pkt 26fpkt", shape=diamond, color=yellow];
1719[label="70.53.62.149;d;1pkt 1fpkt", shape=diamond, color=yellow];
1731[label="70.167.214.23;d;1pkt 1fpkt", shape=diamond, color=yellow];
1736[label="70.167.93.119;d;1pkt 1fpkt", shape=diamond, color=yellow];
1746[label="70.162.224.196;d;1pkt 1fpkt", shape=diamond, color=yellow];
1791[label="213.73.115.20;d;1pkt 1fpkt", shape=diamond, color=yellow];
1853[label="23.238.61.220;d;1pkt 1fpkt", shape=diamond, color=yellow];
1859[label="70.160.180.197;d;1pkt 1fpkt", shape=diamond, color=yellow];
1861[label="200.209.186.27;d;1pkt 1fpkt", shape=diamond, color=yellow];
1941[label="212.176.153.133;d;1pkt 1fpkt", shape=diamond, color=yellow];
2053[label="70.167.60.29;d;1pkt 1fpkt", shape=diamond, color=yellow];
2132[label="195.162.231.162;d;1pkt 1fpkt", shape=diamond, color=yellow];
2198[label="62.137.45.82;d;1pkt 1fpkt", shape=diamond, color=yellow];
2244[label="62.180.209.121;d;1pkt 1fpkt", shape=diamond, color=yellow];
2451[label="220.212.197.157;d;1pkt 1fpkt", shape=diamond, color=yellow];
2506[label="71.234.86.8;d;1pkt 1fpkt", shape=diamond, color=yellow];
2580[label="213.165.147.248;d;1pkt 1fpkt", shape=diamond, color=yellow];
2613[label="61.7.42.166;d;1pkt 1fpkt", shape=diamond, color=yellow];
2660[label="193.117.0.13;d;1pkt 1fpkt", shape=diamond, color=yellow];
2671[label="71.226.48.217;d;1pkt 1fpkt", shape=diamond, color=yellow];
2672[label="212.177.13.186;d;1pkt 1fpkt", shape=diamond, color=yellow];
2673[label="219.247.106.228;d;1pkt 1fpkt", shape=diamond, color=yellow];
2674[label="4.11.178.220;d;1pkt 1fpkt", shape=diamond, color=yellow];
2746[label="70.167.93.119;d;1pkt 1fpkt", shape=hexagon, color=black];
2767[label="23.238.61.220;d;1pkt 1fpkt", shape=hexagon, color=black];
2923[label="70.167.214.23;d;1pkt 1fpkt", shape=hexagon, color=black];
2951[label="70.167.197.136;d;26pkt 26fpkt", shape=hexagon, color=black];
2969[label="70.53.62.149;d;1pkt 1fpkt", shape=hexagon, color=black];
2970[label="70.167.60.29;d;1pkt 1fpkt", shape=hexagon, color=black];
2974[label="200.209.186.27;d;1pkt 1fpkt", shape=hexagon, color=black];
3085[label="70.160.180.197;d;1pkt 1fpkt", shape=hexagon, color=black];
3102[label="71.234.86.8;d;1pkt 1fpkt", shape=hexagon, color=black];
3131[label="213.165.147.248;d;1pkt 1fpkt", shape=hexagon, color=black];
3175[label="220.212.197.157;d;1pkt 1fpkt", shape=hexagon, color=black];
3211[label="4.11.178.220;d;1pkt 1fpkt", shape=hexagon, color=black];
4415[label="168.125.205.3;1368pkt 1368fpkt", shape=invtriangle, color=brown];
stat547[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.125.205.3:*, *:4662}[63.9416%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4662: (31.3283%)&lt;BR/&gt; 3584: (6.37308%)&lt;BR/&gt; 80: (5.85392%)&lt;BR/&gt; 4665: (4.51128%)&lt;BR/&gt; 413: (1.9155%)&gt;];
}
2--702[label="1;2pkt 2fpkt"];
2--1660[label="1;2pkt 2fpkt"];
2--1702[label="0.5;1pkt 1fpkt"];
2--1746[label="1;1pkt 1fpkt"];
2--2951[label="0.5;1pkt 1fpkt"];
2--4415[label="1;2pkt 2fpkt"];
656--1660[label="1;1pkt 1fpkt"];
656--2132[label="1;1pkt 1fpkt"];
656--4415[label="1;1pkt 1fpkt"];
702--1660[label="1;2pkt 2fpkt"];
702--1702[label="0.5;1pkt 1fpkt"];
702--1746[label="1;1pkt 1fpkt"];
702--2951[label="0.5;1pkt 1fpkt"];
702--4415[label="1;2pkt 2fpkt"];
1660--1702[label="1;26pkt 26fpkt"];
1660--1719[label="1;1pkt 1fpkt"];
1660--1731[label="1;1pkt 1fpkt"];
1660--1736[label="1;1pkt 1fpkt"];
1660--1746[label="1;1pkt 1fpkt"];
1660--1791[label="1;1pkt 1fpkt"];
1660--1853[label="1;1pkt 1fpkt"];
1660--1859[label="1;1pkt 1fpkt"];
1660--1861[label="1;1pkt 1fpkt"];
1660--1941[label="1;1pkt 1fpkt"];
1660--2053[label="1;1pkt 1fpkt"];
1660--2132[label="1;1pkt 1fpkt"];
1660--2198[label="1;1pkt 1fpkt"];
1660--2244[label="1;1pkt 1fpkt"];
1660--2356[label="0.705882;12pkt 12fpkt"];
1660--2378[label="0.473684;9pkt 9fpkt"];
1660--2393[label="0.590909;13pkt 13fpkt"];
1660--2433[label="0.5;5pkt 5fpkt"];
1660--2435[label="0.75;9pkt 9fpkt"];
1660--2451[label="1;1pkt 1fpkt"];
1660--2489[label="0.75;9pkt 9fpkt"];
1660--2490[label="0.777778;7pkt 7fpkt"];
1660--2491[label="0.764706;13pkt 13fpkt"];
1660--2506[label="1;1pkt 1fpkt"];
1660--2545[label="0.75;12pkt 12fpkt"];
1660--2580[label="1;1pkt 1fpkt"];
1660--2581[label="0.285714;4pkt 4fpkt"];
1660--2601[label="0.714286;5pkt 5fpkt"];
1660--2613[label="1;1pkt 1fpkt"];
1660--2660[label="1;1pkt 1fpkt"];
1660--2671[label="1;1pkt 1fpkt"];
1660--2672[label="1;1pkt 1fpkt"];
1660--2673[label="1;1pkt 1fpkt"];
1660--2674[label="1;1pkt 1fpkt"];
1660--2746[label="1;1pkt 1fpkt"];
1660--2767[label="1;1pkt 1fpkt"];
1660--2923[label="1;1pkt 1fpkt"];
1660--2951[label="1;26pkt 26fpkt"];
1660--2969[label="1;1pkt 1fpkt"];
1660--2970[label="1;1pkt 1fpkt"];
1660--2974[label="1;1pkt 1fpkt"];
1660--3007[label="0.7;7pkt 7fpkt"];
1660--3024[label="0.473684;9pkt 9fpkt"];
1660--3029[label="0.5;6pkt 6fpkt"];
1660--3064[label="0.714286;5pkt 5fpkt"];
1660--3085[label="1;1pkt 1fpkt"];
1660--3102[label="1;1pkt 1fpkt"];
1660--3131[label="1;1pkt 1fpkt"];
1660--3175[label="1;1pkt 1fpkt"];
1660--3211[label="1;1pkt 1fpkt"];
1660--3275[label="0.00149813;2pkt 2fpkt"];
1660--3279[label="0.00674157;9pkt 9fpkt"];
1660--3283[label="0.00674157;9pkt 9fpkt"];
1660--3284[label="0.00374532;5pkt 5fpkt"];
1660--3289[label="0.00149813;2pkt 2fpkt"];
1660--3294[label="0.00674157;9pkt 9fpkt"];
1660--3298[label="0.00149813;2pkt 2fpkt"];
1660--4415[label="0.998502;1333pkt 1333fpkt"];
1702--2951[label="1;26pkt 26fpkt"];
1702--4415[label="1;26pkt 26fpkt"];
1719--2969[label="1;1pkt 1fpkt"];
1719--4415[label="1;1pkt 1fpkt"];
1731--2923[label="1;1pkt 1fpkt"];
1731--4415[label="1;1pkt 1fpkt"];
1736--2746[label="1;1pkt 1fpkt"];
1736--4415[label="1;1pkt 1fpkt"];
1746--4415[label="1;1pkt 1fpkt"];
1791--4415[label="1;1pkt 1fpkt"];
1853--2767[label="1;1pkt 1fpkt"];
1853--4415[label="1;1pkt 1fpkt"];
1859--3085[label="1;1pkt 1fpkt"];
1859--4415[label="1;1pkt 1fpkt"];
1861--2974[label="1;1pkt 1fpkt"];
1861--4415[label="1;1pkt 1fpkt"];
1941--4415[label="1;1pkt 1fpkt"];
2053--2970[label="1;1pkt 1fpkt"];
2053--4415[label="1;1pkt 1fpkt"];
2132--4415[label="1;1pkt 1fpkt"];
2198--4415[label="1;1pkt 1fpkt"];
2244--4415[label="1;1pkt 1fpkt"];
2451--3175[label="1;1pkt 1fpkt"];
2451--4415[label="1;1pkt 1fpkt"];
2506--3102[label="1;1pkt 1fpkt"];
2506--4415[label="1;1pkt 1fpkt"];
2580--3131[label="1;1pkt 1fpkt"];
2580--4415[label="1;1pkt 1fpkt"];
2613--4415[label="1;1pkt 1fpkt"];
2660--4415[label="1;1pkt 1fpkt"];
2671--4415[label="1;1pkt 1fpkt"];
2672--4415[label="1;1pkt 1fpkt"];
2673--4415[label="1;1pkt 1fpkt"];
2674--3211[label="1;1pkt 1fpkt"];
2674--4415[label="1;1pkt 1fpkt"];
2746--4415[label="1;1pkt 1fpkt"];
2767--4415[label="1;1pkt 1fpkt"];
2923--4415[label="1;1pkt 1fpkt"];
2951--4415[label="1;26pkt 26fpkt"];
2969--4415[label="1;1pkt 1fpkt"];
2970--4415[label="1;1pkt 1fpkt"];
2974--4415[label="1;1pkt 1fpkt"];
3085--4415[label="1;1pkt 1fpkt"];
3102--4415[label="1;1pkt 1fpkt"];
3131--4415[label="1;1pkt 1fpkt"];
3175--4415[label="1;1pkt 1fpkt"];
3211--4415[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="4662" src_ip="168.125.205.3"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.04343,1.95109,501,1 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_548{
style=filled;
color=gray75;
71[label="203.59.16.228s;1pkt 1fpkt", shape=rectangle, color=red];
1707[label="203.59.16.228;s;5pkt 5fpkt", shape=diamond, color=yellow];
1708[label="203.132.228.74;d;1pkt 1fpkt", shape=diamond, color=yellow];
2342[label="136.234.78.149;s;46pkt 46fpkt", shape=diamond, color=yellow];
2487[label="213.4.168.67;d;5pkt 5fpkt", shape=diamond, color=yellow];
2877[label="203.59.16.228;s;4pkt 4fpkt", shape=hexagon, color=black];
stat548[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.78.149:*, 152.2.129.196:*}[32.6923%]&lt;BR/&gt;{136.234.78.149:21, *:*}[23.0769%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (19.3548%)&lt;BR/&gt; 0: (11.2903%)&lt;BR/&gt; 48817: (3.22581%)&lt;BR/&gt; 46750: (3.22581%)&lt;BR/&gt; 4070: (2.41935%)&gt;];
}
71--1707[label="1;1pkt 1fpkt"];
71--1708[label="1;1pkt 1fpkt"];
71--2877[label="1;1pkt 1fpkt"];
1707--1708[label="1;1pkt 1fpkt"];
1707--2487[label="0.4;2pkt 2fpkt"];
1707--2877[label="1;4pkt 4fpkt"];
1708--2877[label="1;1pkt 1fpkt"];
2342--2487[label="0.4;2pkt 2fpkt"];
2487--2699[label="0.2;1pkt 1fpkt"];
2487--2877[label="0.5;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="152.2.129.196" src_ip="136.234.78.149"/>
      <filter src_ip="136.234.78.149" src_port="21"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.768632,1.92929,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_549{
style=filled;
color=gray75;
1706[label="203.59.16.228;d;1pkt 1fpkt", shape=diamond, color=yellow];
1709[label="203.132.228.74;s;1pkt 1fpkt", shape=diamond, color=yellow];
3671[label="203.132.228.74;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat549[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.132.228.74:46750, 203.59.16.228:48817}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 48817: (50%)&lt;BR/&gt; 46750: (50%)&gt;];
}
1706--1709[label="1;1pkt 1fpkt"];
1706--3671[label="1;1pkt 1fpkt"];
1709--3671[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="203.59.16.228" dst_port="48817" src_ip="203.132.228.74" src_port="46750"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.12311,1.93527,999,1 0 0 1 1 0 0 0 0 0 1 0 ">
    <description>subgraph cluster_554{
style=filled;
color=gray75;
54[label="219.104.39.140s;2pkt 2fpkt", shape=rectangle, color=red];
1739[label="203.11.239.24;d;1pkt 1fpkt", shape=diamond, color=yellow];
1740[label="219.104.39.140;s;1pkt 1fpkt", shape=diamond, color=yellow];
3080[label="203.11.239.24;d;1pkt 1fpkt", shape=hexagon, color=black];
4529[label="90.244.81.43;4pkt 4fpkt", shape=invtriangle, color=brown];
stat554[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.104.39.140:20, 203.11.239.24:1075}[20%]&lt;BR/&gt;{90.244.81.43:80, 136.234.78.215:2589}[20%]&lt;BR/&gt;{90.244.81.43:80, 136.234.78.215:2780}[20%]&lt;BR/&gt;{90.244.81.43:80, 136.234.78.215:3794}[20%]&lt;BR/&gt;{90.244.81.43:80, 136.234.78.215:3816}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (27.7778%)&lt;BR/&gt; 1075: (22.2222%)&lt;BR/&gt; 20: (22.2222%)&lt;BR/&gt; 2589: (11.1111%)&lt;BR/&gt; 3816: (5.55556%)&gt;];
}
54--1739[label="1;1pkt 1fpkt"];
54--1740[label="1;1pkt 1fpkt"];
54--1749[label="0.5;1pkt 1fpkt"];
54--2748[label="0.5;1pkt 1fpkt"];
54--3080[label="1;1pkt 1fpkt"];
54--4529[label="0.5;1pkt 1fpkt"];
1739--1740[label="1;1pkt 1fpkt"];
1739--3080[label="1;1pkt 1fpkt"];
1740--3080[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="136.234.78.215" dst_port="3816" src_ip="90.244.81.43" src_port="80"/>
      <filter dst_ip="136.234.78.215" dst_port="3794" src_ip="90.244.81.43" src_port="80"/>
      <filter dst_ip="136.234.78.215" dst_port="2780" src_ip="90.244.81.43" src_port="80"/>
      <filter dst_ip="136.234.78.215" dst_port="2589" src_ip="90.244.81.43" src_port="80"/>
      <filter dst_ip="203.11.239.24" dst_port="1075" src_ip="219.104.39.140" src_port="20"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398783" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.04343,1.95109,999,1 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_555{
style=filled;
color=gray75;
75[label="204.79.38.242s;1pkt 1fpkt", shape=rectangle, color=red];
1674[label="203.59.18.72;d;87pkt 87fpkt", shape=diamond, color=yellow];
1753[label="204.79.38.242;s;27pkt 27fpkt", shape=diamond, color=yellow];
2912[label="203.59.18.72;d;51pkt 51fpkt", shape=hexagon, color=black];
stat555[shape=component, label=&lt;Rules:&lt;BR/&gt;{90.14.20.17:*, 203.59.18.72:80}[57.4713%]&lt;BR/&gt;{204.79.38.242:*, 203.59.18.72:*}[31.0345%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (25%)&lt;BR/&gt; 21: (4.21687%)&lt;BR/&gt; 4821: (1.20482%)&lt;BR/&gt; 2287: (1.20482%)&lt;BR/&gt; 54900: (0.903614%)&gt;];
}
75--1674[label="1;1pkt 1fpkt"];
75--1753[label="1;1pkt 1fpkt"];
75--2912[label="1;1pkt 1fpkt"];
1674--1753[label="1;27pkt 27fpkt"];
1674--2912[label="1;51pkt 51fpkt"];
1674--3275[label="0.0229885;2pkt 2fpkt"];
1674--3279[label="0.0114943;1pkt 1fpkt"];
1674--3283[label="0.0229885;2pkt 2fpkt"];
1674--3284[label="0.0114943;1pkt 1fpkt"];
1674--3289[label="0.0229885;2pkt 2fpkt"];
1674--3294[label="0.0114943;1pkt 1fpkt"];
1674--3298[label="0.0229885;2pkt 2fpkt"];
1753--2912[label="0.962963;26pkt 26fpkt"];
2912--3275[label="0.0392157;2pkt 2fpkt"];
2912--3289[label="0.0392157;2pkt 2fpkt"];
2912--3298[label="0.0392157;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="203.59.18.72" src_ip="204.79.38.242"/>
      <filter dst_ip="203.59.18.72" dst_port="80" src_ip="90.14.20.17"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.09123,1.91892,999,1 1 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_558{
style=filled;
color=gray75;
26[label="4.169.145.56s;1pkt 1fpkt", shape=rectangle, color=red];
84[label="136.234.179.122d;2pkt 2fpkt", shape=rectangle, color=red];
450[label="89.3.4.165s;1pkt 1fpkt", shape=rectangle, color=red];
719[label="4.169.145.56s;1pkt 1fpkt", shape=ellipse, color=green];
1650[label="136.234.179.122;d;263pkt 263fpkt", shape=diamond, color=yellow];
1801[label="4.169.145.56;s;1pkt 1fpkt", shape=diamond, color=yellow];
1803[label="89.0.14.142;s;1pkt 1fpkt", shape=diamond, color=yellow];
1823[label="89.0.88.47;s;1pkt 1fpkt", shape=diamond, color=yellow];
2366[label="213.22.98.9;s;1pkt 1fpkt", shape=diamond, color=yellow];
2796[label="136.234.179.122;d;183pkt 183fpkt", shape=hexagon, color=black];
2843[label="4.169.145.56;s;1pkt 1fpkt", shape=hexagon, color=black];
3182[label="213.22.98.9;s;1pkt 1fpkt", shape=hexagon, color=black];
stat558[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:6257, 136.234.179.122:6260}[93.5361%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6260: (47.3742%)&lt;BR/&gt; 6257: (45.733%)&lt;BR/&gt; 6697: (1.85996%)&lt;BR/&gt; 1395: (0.765864%)&lt;BR/&gt; 16257: (0.437637%)&gt;];
}
26--84[label="1;1pkt 1fpkt"];
26--719[label="1;1pkt 1fpkt"];
26--1650[label="1;1pkt 1fpkt"];
26--1801[label="1;1pkt 1fpkt"];
26--2796[label="1;1pkt 1fpkt"];
26--2843[label="1;1pkt 1fpkt"];
84--719[label="1;1pkt 1fpkt"];
84--1650[label="1;2pkt 2fpkt"];
84--1801[label="1;1pkt 1fpkt"];
84--1823[label="1;1pkt 1fpkt"];
84--2796[label="1;2pkt 2fpkt"];
84--2843[label="1;1pkt 1fpkt"];
450--1650[label="1;1pkt 1fpkt"];
450--2796[label="1;1pkt 1fpkt"];
719--1650[label="1;1pkt 1fpkt"];
719--1801[label="1;1pkt 1fpkt"];
719--2796[label="1;1pkt 1fpkt"];
719--2843[label="1;1pkt 1fpkt"];
1650--1801[label="1;1pkt 1fpkt"];
1650--1803[label="1;1pkt 1fpkt"];
1650--1823[label="1;1pkt 1fpkt"];
1650--2366[label="1;1pkt 1fpkt"];
1650--2796[label="1;183pkt 183fpkt"];
1650--2843[label="1;1pkt 1fpkt"];
1650--3182[label="1;1pkt 1fpkt"];
1801--2796[label="1;1pkt 1fpkt"];
1801--2843[label="1;1pkt 1fpkt"];
1803--2796[label="1;1pkt 1fpkt"];
1823--2796[label="1;1pkt 1fpkt"];
2366--2796[label="1;1pkt 1fpkt"];
2366--3182[label="1;1pkt 1fpkt"];
2796--2843[label="1;1pkt 1fpkt"];
2796--3182[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="136.234.179.122" dst_port="6260" src_port="6257"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.946667,1.87498,999,1 1 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_559{
style=filled;
color=gray75;
204[label="4.29.195.50s;1pkt 1fpkt", shape=rectangle, color=red];
846[label="4.29.195.50s;1pkt 1fpkt", shape=ellipse, color=green];
1340[label="4.29.195.50s;1pkt 1fpkt", shape=triangle, color=blue];
1812[label="4.203.247.50;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat559[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.203.247.50:6699, 148.132.180.56:1568}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (50%)&lt;BR/&gt; 1568: (50%)&gt;];
}
204--846[label="1;1pkt 1fpkt"];
204--1340[label="1;1pkt 1fpkt"];
204--1697[label="1;1pkt 1fpkt"];
204--1812[label="1;1pkt 1fpkt"];
204--3012[label="1;1pkt 1fpkt"];
846--1340[label="1;1pkt 1fpkt"];
846--1697[label="1;1pkt 1fpkt"];
846--1812[label="1;1pkt 1fpkt"];
846--3012[label="1;1pkt 1fpkt"];
1340--1697[label="1;1pkt 1fpkt"];
1340--1812[label="1;1pkt 1fpkt"];
1340--3012[label="1;1pkt 1fpkt"];
1812--3012[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="148.132.180.56" dst_port="1568" src_ip="4.203.247.50" src_port="6699"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.0989,1.87859,999,1 1 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_560{
style=filled;
color=gray75;
20[label="148.155.247.29s;3pkt 3fpkt", shape=rectangle, color=red];
715[label="148.155.247.29s;3pkt 3fpkt", shape=ellipse, color=green];
1654[label="148.155.247.29;s;2433pkt 2433fpkt", shape=diamond, color=yellow];
1827[label="175.45.110.109;d;1pkt 1fpkt", shape=diamond, color=yellow];
1833[label="4.129.197.26;d;1pkt 1fpkt", shape=diamond, color=yellow];
1892[label="4.147.177.127;d;1pkt 1fpkt", shape=diamond, color=yellow];
1979[label="154.169.4.191;d;1pkt 1fpkt", shape=diamond, color=yellow];
1991[label="219.172.216.75;d;1pkt 1fpkt", shape=diamond, color=yellow];
2060[label="219.171.157.48;d;1pkt 1fpkt", shape=diamond, color=yellow];
2461[label="70.194.211.171;d;1pkt 1fpkt", shape=diamond, color=yellow];
2801[label="4.147.177.127;d;1pkt 1fpkt", shape=hexagon, color=black];
2848[label="4.129.197.26;d;1pkt 1fpkt", shape=hexagon, color=black];
2922[label="175.45.110.109;d;1pkt 1fpkt", shape=hexagon, color=black];
2928[label="219.171.157.48;d;1pkt 1fpkt", shape=hexagon, color=black];
3084[label="70.194.211.171;d;1pkt 1fpkt", shape=hexagon, color=black];
3481[label="148.155.247.29;4pkt 4fpkt", shape=pentagon, color=darkviolet];
stat560[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.155.247.29:6257, *:6257}[97.9449%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6257: (97.8615%)&lt;BR/&gt; 6970: (0.692464%)&lt;BR/&gt; 16257: (0.264766%)&lt;BR/&gt; 4601: (0.1222%)&lt;BR/&gt; 4287: (0.101833%)&gt;];
}
20--715[label="1;3pkt 3fpkt"];
20--1654[label="1;3pkt 3fpkt"];
20--1827[label="1;1pkt 1fpkt"];
20--1833[label="1;1pkt 1fpkt"];
20--1892[label="1;1pkt 1fpkt"];
20--2801[label="1;1pkt 1fpkt"];
20--2848[label="1;1pkt 1fpkt"];
20--2922[label="1;1pkt 1fpkt"];
20--3481[label="0.333333;1pkt 1fpkt"];
715--1654[label="1;3pkt 3fpkt"];
715--1827[label="1;1pkt 1fpkt"];
715--1833[label="1;1pkt 1fpkt"];
715--1892[label="1;1pkt 1fpkt"];
715--2801[label="1;1pkt 1fpkt"];
715--2848[label="1;1pkt 1fpkt"];
715--2922[label="1;1pkt 1fpkt"];
715--3481[label="0.333333;1pkt 1fpkt"];
1654--1820[label="0.5;1pkt 1fpkt"];
1654--1827[label="1;1pkt 1fpkt"];
1654--1833[label="1;1pkt 1fpkt"];
1654--1892[label="1;1pkt 1fpkt"];
1654--1956[label="0.333333;1pkt 1fpkt"];
1654--1979[label="1;1pkt 1fpkt"];
1654--1991[label="1;1pkt 1fpkt"];
1654--2010[label="0.333333;1pkt 1fpkt"];
1654--2043[label="1;1pkt 1fpkt"];
1654--2060[label="1;1pkt 1fpkt"];
1654--2313[label="1;1pkt 1fpkt"];
1654--2461[label="1;1pkt 1fpkt"];
1654--2801[label="1;1pkt 1fpkt"];
1654--2809[label="0.5;1pkt 1fpkt"];
1654--2848[label="1;1pkt 1fpkt"];
1654--2922[label="1;1pkt 1fpkt"];
1654--2928[label="1;1pkt 1fpkt"];
1654--3043[label="1;1pkt 1fpkt"];
1654--3084[label="1;1pkt 1fpkt"];
1654--3110[label="1;1pkt 1fpkt"];
1654--3277[label="0.143969;111pkt 111fpkt"];
1654--3281[label="0.224414;546pkt 546fpkt"];
1654--3286[label="0.132616;185pkt 185fpkt"];
1654--3291[label="0.143969;111pkt 111fpkt"];
1654--3300[label="0.143969;111pkt 111fpkt"];
1654--3481[label="1;4pkt 4fpkt"];
1827--2922[label="1;1pkt 1fpkt"];
1833--2848[label="1;1pkt 1fpkt"];
1892--2801[label="1;1pkt 1fpkt"];
1892--3481[label="1;1pkt 1fpkt"];
2060--2928[label="1;1pkt 1fpkt"];
2461--3084[label="1;1pkt 1fpkt"];
2461--3481[label="1;1pkt 1fpkt"];
2801--3481[label="1;1pkt 1fpkt"];
3084--3481[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="6257" src_ip="148.155.247.29" src_port="6257"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398824" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757634,1.96858,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_561{
style=filled;
color=gray75;
1847[label="192.85.231.60;d;16pkt 16fpkt", shape=diamond, color=yellow];
1848[label="172.142.192.115;s;33pkt 33fpkt", shape=diamond, color=yellow];
stat561[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.142.192.115:80, 192.85.231.60:*}[48.4848%]&lt;BR/&gt;{172.142.192.115:80, 213.208.155.130:*}[30.303%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (42.8571%)&lt;BR/&gt; 5190: (4.08163%)&lt;BR/&gt; 25: (3.06122%)&lt;BR/&gt; 10898: (2.04082%)&lt;BR/&gt; 10895: (2.04082%)&gt;];
}
1847--1848[label="1;16pkt 16fpkt"];
1848--2931[label="0.121212;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="192.85.231.60" src_ip="172.142.192.115" src_port="80"/>
      <filter dst_ip="213.208.155.130" src_ip="172.142.192.115" src_port="80"/>
    </slice>
    <from sec="1041398216" usec="0"/>
    <to sec="1041398709" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757634,1.96858,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="89.84.37.86"/>
      <from sec="1041397200" usec="0"/>
      <to sec="1041398657" usec="0"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398657" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757634,1.96858,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="203.59.19.6"/>
      <from sec="1041397203" usec="0"/>
      <to sec="1041398747" usec="0"/>
    </slice>
    <from sec="1041397203" usec="0"/>
    <to sec="1041398747" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.873736,1.91329,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_564{
style=filled;
color=gray75;
1880[label="210.106.129.22;s;6pkt 6fpkt", shape=diamond, color=yellow];
1885[label="145.79.169.62;d;2pkt 2fpkt", shape=diamond, color=yellow];
3437[label="210.106.129.22;7pkt 7fpkt", shape=pentagon, color=darkviolet];
4476[label="210.106.129.22;7pkt 7fpkt", shape=invtriangle, color=brown];
stat564[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.106.129.22:1024, *:53}[28.5714%]&lt;BR/&gt;{210.106.129.22:*, *:25}[28.5714%]&lt;BR/&gt;{210.106.129.22:113, *:*}[28.5714%]&lt;BR/&gt;{210.106.129.22:*, 0.83.224.61:*}[28.5714%]&lt;BR/&gt;{210.106.129.22:*, 145.79.169.62:*}[28.5714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 113: (15.9091%)&lt;BR/&gt; 25: (15.9091%)&lt;BR/&gt; 1024: (13.6364%)&lt;BR/&gt; 53: (13.6364%)&lt;BR/&gt; 46442: (9.09091%)&gt;];
}
1880--1885[label="1;2pkt 2fpkt"];
1880--3437[label="1;6pkt 6fpkt"];
1880--4476[label="1;6pkt 6fpkt"];
1885--3437[label="1;2pkt 2fpkt"];
1885--4476[label="1;2pkt 2fpkt"];
3437--4476[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="145.79.169.62" src_ip="210.106.129.22"/>
      <filter dst_ip="0.83.224.61" src_ip="210.106.129.22"/>
      <filter src_ip="210.106.129.22" src_port="113"/>
      <filter dst_port="25" src_ip="210.106.129.22"/>
      <filter dst_port="53" src_ip="210.106.129.22" src_port="1024"/>
    </slice>
    <from sec="1041397229" usec="0"/>
    <to sec="1041398074" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.04343,1.95109,999,1 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_566{
style=filled;
color=gray75;
45[label="4.166.121.117s;1pkt 1fpkt", shape=rectangle, color=red];
1897[label="4.166.121.117;s;1pkt 1fpkt", shape=diamond, color=yellow];
2947[label="4.166.121.117;s;1pkt 1fpkt", shape=hexagon, color=black];
stat566[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.166.121.117:4662, 168.125.47.240:1699}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4662: (50%)&lt;BR/&gt; 1699: (50%)&gt;];
}
45--1648[label="1;1pkt 1fpkt"];
45--1897[label="1;1pkt 1fpkt"];
45--2947[label="1;1pkt 1fpkt"];
1897--2947[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="168.125.47.240" dst_port="1699" src_ip="4.166.121.117" src_port="4662"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_567{
style=filled;
color=gray75;
1696[label="136.234.187.105;s;907pkt 907fpkt", shape=diamond, color=yellow];
1794[label="205.6.163.201;d;1pkt 1fpkt", shape=diamond, color=yellow];
1818[label="90.229.33.197;d;1pkt 1fpkt", shape=diamond, color=yellow];
1856[label="70.129.182.10;d;1pkt 1fpkt", shape=diamond, color=yellow];
1908[label="89.37.98.154;d;1pkt 1fpkt", shape=diamond, color=yellow];
1909[label="90.104.7.178;d;1pkt 1fpkt", shape=diamond, color=yellow];
1913[label="4.144.232.92;d;1pkt 1fpkt", shape=diamond, color=yellow];
2493[label="70.128.221.141;d;1pkt 1fpkt", shape=diamond, color=yellow];
2608[label="91.99.236.80;d;2pkt 2fpkt", shape=diamond, color=yellow];
2609[label="90.232.162.234;d;2pkt 2fpkt", shape=diamond, color=yellow];
2703[label="93.132.232.3;d;2pkt 2fpkt", shape=diamond, color=yellow];
2879[label="90.229.33.197;d;1pkt 1fpkt", shape=hexagon, color=black];
2996[label="70.129.182.10;d;1pkt 1fpkt", shape=hexagon, color=black];
3210[label="90.232.162.234;d;2pkt 2fpkt", shape=hexagon, color=black];
stat567[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.187.105:4662, *:*}[55.237%]&lt;BR/&gt;{136.234.187.105:6257, *:6257}[41.7861%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6257: (41.6126%)&lt;BR/&gt; 4662: (27.2727%)&lt;BR/&gt; 6699: (1.35281%)&lt;BR/&gt; 6688: (0.21645%)&lt;BR/&gt; 8888: (0.162338%)&gt;];
}
1696--1794[label="1;1pkt 1fpkt"];
1696--1818[label="1;1pkt 1fpkt"];
1696--1840[label="1;1pkt 1fpkt"];
1696--1849[label="1;2pkt 2fpkt"];
1696--1856[label="1;1pkt 1fpkt"];
1696--1908[label="1;1pkt 1fpkt"];
1696--1909[label="1;1pkt 1fpkt"];
1696--1913[label="1;1pkt 1fpkt"];
1696--2493[label="1;1pkt 1fpkt"];
1696--2608[label="1;2pkt 2fpkt"];
1696--2609[label="1;2pkt 2fpkt"];
1696--2703[label="1;2pkt 2fpkt"];
1696--2780[label="1;1pkt 1fpkt"];
1696--2784[label="1;2pkt 2fpkt"];
1696--2879[label="1;1pkt 1fpkt"];
1696--2996[label="1;1pkt 1fpkt"];
1696--3210[label="1;2pkt 2fpkt"];
1696--3277[label="0.0207523;16pkt 16fpkt"];
1696--3281[label="0.0727674;66pkt 66fpkt"];
1696--3286[label="0.0209482;19pkt 19fpkt"];
1696--3291[label="0.0207523;16pkt 16fpkt"];
1696--3300[label="0.0207523;16pkt 16fpkt"];
1818--2879[label="1;1pkt 1fpkt"];
1856--2996[label="1;1pkt 1fpkt"];
2609--3210[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter src_ip="136.234.187.105" src_port="4662"/>
      <filter dst_port="6257" src_ip="136.234.187.105" src_port="6257"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.13055,1.89529,999,1 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_569{
style=filled;
color=gray75;
448[label="91.85.195.162s;1pkt 1fpkt", shape=rectangle, color=red];
1924[label="195.162.231.162;s;1pkt 1fpkt", shape=diamond, color=yellow];
2924[label="195.162.231.162;s;1pkt 1fpkt", shape=hexagon, color=black];
4070[label="195.162.231.162;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4813[label="195.162.231.162;1pkt 1fpkt", shape=invtriangle, color=brown];
stat569[shape=component, label=&lt;Rules:&lt;BR/&gt;{195.162.231.162:5555, 168.125.205.3:4561}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5555: (50%)&lt;BR/&gt; 4561: (50%)&gt;];
}
448--1891[label="1;1pkt 1fpkt"];
448--1924[label="1;1pkt 1fpkt"];
448--2924[label="1;1pkt 1fpkt"];
448--2963[label="1;1pkt 1fpkt"];
448--3250[label="1;1pkt 1fpkt"];
448--4070[label="1;1pkt 1fpkt"];
448--4813[label="1;1pkt 1fpkt"];
1924--2924[label="1;1pkt 1fpkt"];
1924--2963[label="1;1pkt 1fpkt"];
1924--3250[label="1;1pkt 1fpkt"];
1924--4070[label="1;1pkt 1fpkt"];
1924--4813[label="1;1pkt 1fpkt"];
2924--2963[label="1;1pkt 1fpkt"];
2924--3250[label="1;1pkt 1fpkt"];
2924--4070[label="1;1pkt 1fpkt"];
2924--4813[label="1;1pkt 1fpkt"];
4070--4813[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="168.125.205.3" dst_port="4561" src_ip="195.162.231.162" src_port="5555"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.17951,1.89871,999,1 1 1 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_572{
style=filled;
color=gray75;
183[label="217.34.167.40s;1pkt 1fpkt", shape=rectangle, color=red];
829[label="217.34.167.40s;1pkt 1fpkt", shape=ellipse, color=green];
1328[label="217.34.167.40s;1pkt 1fpkt", shape=triangle, color=blue];
1985[label="148.155.168.5;d;2pkt 2fpkt", shape=diamond, color=yellow];
2059[label="90.107.31.40;s;1pkt 1fpkt", shape=diamond, color=yellow];
2927[label="148.155.168.5;d;2pkt 2fpkt", shape=hexagon, color=black];
stat572[shape=component, label=&lt;Rules:&lt;BR/&gt;{90.107.31.40:6699, 148.155.168.5:26012}[50%]&lt;BR/&gt;{205.65.18.44:1863, 148.155.168.5:25999}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 26012: (37.5%)&lt;BR/&gt; 6699: (37.5%)&lt;BR/&gt; 25999: (12.5%)&lt;BR/&gt; 1863: (12.5%)&gt;];
}
183--829[label="1;1pkt 1fpkt"];
183--1328[label="1;1pkt 1fpkt"];
183--1985[label="1;1pkt 1fpkt"];
183--2059[label="1;1pkt 1fpkt"];
183--2927[label="1;1pkt 1fpkt"];
829--1328[label="1;1pkt 1fpkt"];
829--1985[label="1;1pkt 1fpkt"];
829--2059[label="1;1pkt 1fpkt"];
829--2927[label="1;1pkt 1fpkt"];
1328--1985[label="1;1pkt 1fpkt"];
1328--2059[label="1;1pkt 1fpkt"];
1328--2927[label="1;1pkt 1fpkt"];
1985--2059[label="1;1pkt 1fpkt"];
1985--2927[label="1;2pkt 2fpkt"];
2059--2927[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="148.155.168.5" dst_port="25999" src_ip="205.65.18.44" src_port="1863"/>
      <filter dst_ip="148.155.168.5" dst_port="26012" src_ip="90.107.31.40" src_port="6699"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757634,1.96858,012,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_575{
style=filled;
color=gray75;
2031[label="203.59.18.129;s;16pkt 16fpkt", shape=diamond, color=yellow];
2032[label="202.95.178.53;d;16pkt 16fpkt", shape=diamond, color=yellow];
stat575[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.59.18.129:80, 202.95.178.53:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 57141: (3.125%)&lt;BR/&gt; 57091: (3.125%)&lt;BR/&gt; 57047: (3.125%)&lt;BR/&gt; 56988: (3.125%)&gt;];
}
2031--2032[label="1;16pkt 16fpkt"];
</description>
    <slice>
      <filter dst_ip="202.95.178.53" src_ip="203.59.18.129" src_port="80"/>
    </slice>
    <from sec="1041397477" usec="0"/>
    <to sec="1041397546" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_579{
style=filled;
color=gray75;
1865[label="136.234.117.120;s;523pkt 523fpkt", shape=diamond, color=yellow];
2115[label="213.209.15.160;d;13pkt 13fpkt", shape=diamond, color=yellow];
2354[label="210.174.206.3;d;3pkt 3fpkt", shape=diamond, color=yellow];
2941[label="213.209.15.160;d;10pkt 10fpkt", shape=hexagon, color=black];
stat579[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.117.120:*, *:80}[55.5556%]&lt;BR/&gt;{136.234.117.120:*, *:8080}[27.8719%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (27.4135%)&lt;BR/&gt; 8080: (14.1166%)&lt;BR/&gt; 3128: (7.65027%)&lt;BR/&gt; 8000: (0.819672%)&lt;BR/&gt; 3775: (0.273224%)&gt;];
}
1865--2115[label="0.538462;7pkt 7fpkt"];
1865--2354[label="0.333333;1pkt 1fpkt"];
1865--2941[label="0.7;7pkt 7fpkt"];
1865--3275[label="0.0210325;11pkt 11fpkt"];
1865--3279[label="0.0267686;14pkt 14fpkt"];
1865--3283[label="0.00956023;5pkt 5fpkt"];
1865--3289[label="0.0210325;11pkt 11fpkt"];
1865--3294[label="0.0267686;14pkt 14fpkt"];
1865--3298[label="0.0210325;11pkt 11fpkt"];
2115--2941[label="1;10pkt 10fpkt"];
2354--2864[label="0.666667;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="136.234.117.120"/>
      <filter dst_port="8080" src_ip="136.234.117.120"/>
    </slice>
    <from sec="1041397203" usec="0"/>
    <to sec="1041398746" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.10027,1.95018,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_580{
style=filled;
color=gray75;
2029[label="136.234.167.73;s;14pkt 14fpkt", shape=diamond, color=yellow];
2116[label="209.97.144.41;d;2pkt 2fpkt", shape=diamond, color=yellow];
3663[label="136.234.167.73;26pkt 26fpkt", shape=pentagon, color=darkviolet];
4589[label="136.234.167.73;26pkt 26fpkt", shape=invtriangle, color=brown];
5087[label="136.234.167.73;25pkt 25fpkt", shape=invhouse, color=bisque];
stat580[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.167.73:5555, *:*}[53.8462%]&lt;BR/&gt;{136.234.167.73:*, 61.145.228.12:*}[30.7692%]&lt;BR/&gt;{136.234.167.73:*, 93.59.68.178:*}[30.7692%]&lt;BR/&gt;{136.234.167.73:*, *:7743}[26.9231%]&lt;BR/&gt;{136.234.167.73:*, 209.97.144.41:*}[23.0769%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5555: (26.8817%)&lt;BR/&gt; 7743: (13.9785%)&lt;BR/&gt; 7773: (7.52688%)&lt;BR/&gt; 4654: (2.68817%)&lt;BR/&gt; 2637: (2.68817%)&gt;];
}
2029--2116[label="1;2pkt 2fpkt"];
2029--3663[label="1;14pkt 14fpkt"];
2029--4589[label="1;14pkt 14fpkt"];
2029--5087[label="0.928571;13pkt 13fpkt"];
2116--3663[label="1;2pkt 2fpkt"];
2116--4589[label="1;2pkt 2fpkt"];
2116--5087[label="1;2pkt 2fpkt"];
3663--4589[label="1;26pkt 26fpkt"];
3663--5087[label="1;25pkt 25fpkt"];
4589--5087[label="1;25pkt 25fpkt"];
</description>
    <slice>
      <filter dst_ip="93.59.68.178" src_ip="136.234.167.73"/>
      <filter dst_ip="61.145.228.12" src_ip="136.234.167.73"/>
      <filter dst_ip="209.97.144.41" src_ip="136.234.167.73"/>
      <filter src_ip="136.234.167.73" src_port="5555"/>
      <filter dst_port="7743" src_ip="136.234.167.73"/>
    </slice>
    <from sec="1041397446" usec="0"/>
    <to sec="1041398711" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.04205,1.95237,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_581{
style=filled;
color=gray75;
1705[label="172.142.208.139;s;31pkt 31fpkt", shape=diamond, color=yellow];
1743[label="174.0.36.201;d;9pkt 9fpkt", shape=diamond, color=yellow];
2131[label="90.14.128.28;d;3pkt 3fpkt", shape=diamond, color=yellow];
2917[label="172.142.208.139;s;31pkt 31fpkt", shape=hexagon, color=black];
2994[label="174.0.36.201;d;9pkt 9fpkt", shape=hexagon, color=black];
3969[label="172.142.208.139;44pkt 44fpkt", shape=pentagon, color=darkviolet];
stat581[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.142.208.139:*, 206.86.60.32:443}[54.5455%]&lt;BR/&gt;{172.142.208.139:*, 174.0.36.201:20}[20.4545%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 20: (19.2913%)&lt;BR/&gt; 443: (18.8976%)&lt;BR/&gt; 25: (8.26772%)&lt;BR/&gt; 21: (3.54331%)&lt;BR/&gt; 56741: (1.9685%)&gt;];
}
1705--1743[label="1;9pkt 9fpkt"];
1705--2131[label="1;3pkt 3fpkt"];
1705--2917[label="1;31pkt 31fpkt"];
1705--2994[label="1;9pkt 9fpkt"];
1705--3969[label="1;31pkt 31fpkt"];
1743--2917[label="1;9pkt 9fpkt"];
1743--2994[label="1;9pkt 9fpkt"];
1743--3969[label="1;9pkt 9fpkt"];
2131--2917[label="1;3pkt 3fpkt"];
2131--3969[label="1;3pkt 3fpkt"];
2917--2994[label="1;9pkt 9fpkt"];
2917--3969[label="1;31pkt 31fpkt"];
2994--3969[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="206.86.60.32" dst_port="443" src_ip="172.142.208.139"/>
      <filter dst_ip="174.0.36.201" dst_port="20" src_ip="172.142.208.139"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.08218,1.9597,999,0 1 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_582{
style=filled;
color=gray75;
872[label="91.16.208.70s;1pkt 1fpkt", shape=ellipse, color=green];
2130[label="168.125.224.70;s;3pkt 3fpkt", shape=diamond, color=yellow];
2136[label="205.119.196.138;d;1pkt 1fpkt", shape=diamond, color=yellow];
2990[label="168.125.224.70;s;3pkt 3fpkt", shape=hexagon, color=black];
3192[label="205.119.196.138;d;1pkt 1fpkt", shape=hexagon, color=black];
stat582[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.125.224.70:1542, 71.212.18.83:6699}[33.3333%]&lt;BR/&gt;{168.125.224.70:1541, 90.86.164.110:6699}[33.3333%]&lt;BR/&gt;{168.125.224.70:1507, 205.119.196.138:6699}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (50%)&lt;BR/&gt; 1507: (27.7778%)&lt;BR/&gt; 1542: (11.1111%)&lt;BR/&gt; 1541: (11.1111%)&gt;];
}
872--2130[label="1;1pkt 1fpkt"];
872--2136[label="1;1pkt 1fpkt"];
872--2990[label="1;1pkt 1fpkt"];
872--3192[label="1;1pkt 1fpkt"];
2130--2136[label="1;1pkt 1fpkt"];
2130--2990[label="1;3pkt 3fpkt"];
2130--3192[label="1;1pkt 1fpkt"];
2136--2990[label="1;1pkt 1fpkt"];
2136--3192[label="1;1pkt 1fpkt"];
2990--3192[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="205.119.196.138" dst_port="6699" src_ip="168.125.224.70" src_port="1507"/>
      <filter dst_ip="90.86.164.110" dst_port="6699" src_ip="168.125.224.70" src_port="1541"/>
      <filter dst_ip="71.212.18.83" dst_port="6699" src_ip="168.125.224.70" src_port="1542"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.17951,1.89871,999,1 1 1 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_583{
style=filled;
color=gray75;
384[label="211.243.148.138s;1pkt 1fpkt", shape=rectangle, color=red];
991[label="211.243.148.138s;1pkt 1fpkt", shape=ellipse, color=green];
1448[label="211.243.148.138s;2pkt 2fpkt", shape=triangle, color=blue];
1805[label="168.125.224.70;d;2pkt 2fpkt", shape=diamond, color=yellow];
1806[label="213.233.192.160;s;1pkt 1fpkt", shape=diamond, color=yellow];
2137[label="205.119.196.138;s;1pkt 1fpkt", shape=diamond, color=yellow];
2845[label="213.233.192.160;s;1pkt 1fpkt", shape=hexagon, color=black];
2875[label="168.125.224.70;d;2pkt 2fpkt", shape=hexagon, color=black];
3152[label="205.119.196.138;s;1pkt 1fpkt", shape=hexagon, color=black];
stat583[shape=component, label=&lt;Rules:&lt;BR/&gt;{90.222.52.138:33701, 203.59.21.3:53}[33.3333%]&lt;BR/&gt;{205.119.196.138:6699, 168.125.224.70:1507}[33.3333%]&lt;BR/&gt;{213.233.192.160:6699, 168.125.224.70:1535}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (45.8333%)&lt;BR/&gt; 1507: (29.1667%)&lt;BR/&gt; 1535: (16.6667%)&lt;BR/&gt; 33701: (4.16667%)&lt;BR/&gt; 53: (4.16667%)&gt;];
}
384--991[label="1;1pkt 1fpkt"];
384--1448[label="1;1pkt 1fpkt"];
384--1805[label="1;1pkt 1fpkt"];
384--2137[label="1;1pkt 1fpkt"];
384--2875[label="1;1pkt 1fpkt"];
384--3152[label="1;1pkt 1fpkt"];
991--1448[label="1;1pkt 1fpkt"];
991--1805[label="1;1pkt 1fpkt"];
991--2137[label="1;1pkt 1fpkt"];
991--2875[label="1;1pkt 1fpkt"];
991--3152[label="1;1pkt 1fpkt"];
1448--1638[label="0.5;1pkt 1fpkt"];
1448--1805[label="0.5;1pkt 1fpkt"];
1448--2137[label="1;1pkt 1fpkt"];
1448--2875[label="0.5;1pkt 1fpkt"];
1448--3152[label="1;1pkt 1fpkt"];
1448--3278[label="0.5;1pkt 1fpkt"];
1448--3282[label="0.5;1pkt 1fpkt"];
1448--3287[label="0.5;1pkt 1fpkt"];
1448--3293[label="0.5;1pkt 1fpkt"];
1448--3296[label="0.5;1pkt 1fpkt"];
1805--1806[label="1;1pkt 1fpkt"];
1805--2137[label="1;1pkt 1fpkt"];
1805--2845[label="1;1pkt 1fpkt"];
1805--2875[label="1;2pkt 2fpkt"];
1805--3152[label="1;1pkt 1fpkt"];
1806--2845[label="1;1pkt 1fpkt"];
1806--2875[label="1;1pkt 1fpkt"];
2137--2875[label="1;1pkt 1fpkt"];
2137--3152[label="1;1pkt 1fpkt"];
2845--2875[label="1;1pkt 1fpkt"];
2875--3152[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="168.125.224.70" dst_port="1535" src_ip="213.233.192.160" src_port="6699"/>
      <filter dst_ip="168.125.224.70" dst_port="1507" src_ip="205.119.196.138" src_port="6699"/>
      <filter dst_ip="203.59.21.3" dst_port="53" src_ip="90.222.52.138" src_port="33701"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757634,1.96858,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_584{
style=filled;
color=gray75;
2151[label="144.52.66.93;d;4pkt 4fpkt", shape=diamond, color=yellow];
2510[label="4.137.119.39;s;1pkt 1fpkt", shape=diamond, color=yellow];
2714[label="154.179.88.95;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat584[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.137.119.39:6699, 144.52.66.93:1074}[25%]&lt;BR/&gt;{193.112.64.58:6699, 144.52.66.93:1053}[25%]&lt;BR/&gt;{154.179.88.95:6699, 144.52.66.93:1077}[25%]&lt;BR/&gt;{219.140.128.108:6699, 144.52.66.93:1070}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (50%)&lt;BR/&gt; 1077: (16.6667%)&lt;BR/&gt; 1074: (16.6667%)&lt;BR/&gt; 1070: (8.33333%)&lt;BR/&gt; 1053: (8.33333%)&gt;];
}
2151--2152[label="1;1pkt 1fpkt"];
2151--2510[label="1;1pkt 1fpkt"];
2151--2714[label="1;1pkt 1fpkt"];
2151--2897[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="144.52.66.93" dst_port="1070" src_ip="219.140.128.108" src_port="6699"/>
      <filter dst_ip="144.52.66.93" dst_port="1077" src_ip="154.179.88.95" src_port="6699"/>
      <filter dst_ip="144.52.66.93" dst_port="1053" src_ip="193.112.64.58" src_port="6699"/>
      <filter dst_ip="144.52.66.93" dst_port="1074" src_ip="4.137.119.39" src_port="6699"/>
    </slice>
    <from sec="1041397209" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.17951,1.89871,002,1 1 1 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_586{
style=filled;
color=gray75;
295[label="88.117.133.100s;203pkt 203fpkt", shape=rectangle, color=red];
918[label="88.117.133.100s;203pkt 203fpkt", shape=ellipse, color=green];
1390[label="88.117.133.100s;203pkt 203fpkt", shape=triangle, color=blue];
2173[label="172.142.204.157;d;3pkt 3fpkt", shape=diamond, color=yellow];
2176[label="195.49.71.36;s;1pkt 1fpkt", shape=diamond, color=yellow];
3111[label="195.49.71.36;s;1pkt 1fpkt", shape=hexagon, color=black];
stat586[shape=component, label=&lt;Rules:&lt;BR/&gt;{88.117.133.100:1029, *:137}[99.0244%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (49.6743%)&lt;BR/&gt; 137: (49.6743%)&lt;BR/&gt; 6667: (0.2443%)&lt;BR/&gt; 1924: (0.2443%)&lt;BR/&gt; 5190: (0.0814332%)&gt;];
}
295--918[label="1;203pkt 203fpkt"];
295--1390[label="1;203pkt 203fpkt"];
295--2173[label="0.333333;1pkt 1fpkt"];
295--3276[label="1;203pkt 203fpkt"];
295--3290[label="1;203pkt 203fpkt"];
295--3299[label="1;203pkt 203fpkt"];
918--1390[label="1;203pkt 203fpkt"];
918--2173[label="0.333333;1pkt 1fpkt"];
918--3276[label="1;203pkt 203fpkt"];
918--3290[label="1;203pkt 203fpkt"];
918--3299[label="1;203pkt 203fpkt"];
1390--2173[label="0.333333;1pkt 1fpkt"];
1390--3276[label="1;203pkt 203fpkt"];
1390--3290[label="1;203pkt 203fpkt"];
1390--3299[label="1;203pkt 203fpkt"];
2173--2176[label="1;1pkt 1fpkt"];
2173--3111[label="1;1pkt 1fpkt"];
2173--3276[label="0.333333;1pkt 1fpkt"];
2173--3290[label="0.333333;1pkt 1fpkt"];
2173--3299[label="0.333333;1pkt 1fpkt"];
2176--3111[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="88.117.133.100" src_port="1029"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.04205,1.95237,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_587{
style=filled;
color=gray75;
1668[label="136.234.118.106;s;1389pkt 1389fpkt", shape=diamond, color=yellow];
1669[label="4.137.64.34;d;1pkt 1fpkt", shape=diamond, color=yellow];
1733[label="70.46.117.15;d;1pkt 1fpkt", shape=diamond, color=yellow];
1787[label="93.244.41.146;d;2pkt 2fpkt", shape=diamond, color=yellow];
1820[label="23.196.230.162;d;2pkt 2fpkt", shape=diamond, color=yellow];
1918[label="71.168.62.179;d;1pkt 1fpkt", shape=diamond, color=yellow];
1996[label="93.56.34.25;d;1pkt 1fpkt", shape=diamond, color=yellow];
2564[label="93.212.193.184;d;2pkt 2fpkt", shape=diamond, color=yellow];
2809[label="23.196.230.162;d;2pkt 2fpkt", shape=hexagon, color=black];
2911[label="4.137.64.34;d;1pkt 1fpkt", shape=hexagon, color=black];
3105[label="93.212.193.184;d;2pkt 2fpkt", shape=hexagon, color=black];
3190[label="71.168.62.179;d;1pkt 1fpkt", shape=hexagon, color=black];
3797[label="136.234.118.106;5pkt 5fpkt", shape=pentagon, color=darkviolet];
stat587[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.118.106:6257, *:6257}[97.1223%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6257: (97.0922%)&lt;BR/&gt; 6699: (0.992908%)&lt;BR/&gt; 16257: (0.141844%)&lt;BR/&gt; 2933: (0.141844%)&lt;BR/&gt; 1106: (0.141844%)&gt;];
}
1668--1669[label="1;1pkt 1fpkt"];
1668--1733[label="1;1pkt 1fpkt"];
1668--1787[label="1;2pkt 2fpkt"];
1668--1802[label="0.333333;1pkt 1fpkt"];
1668--1819[label="1;1pkt 1fpkt"];
1668--1820[label="0.5;1pkt 1fpkt"];
1668--1918[label="1;1pkt 1fpkt"];
1668--1996[label="1;1pkt 1fpkt"];
1668--2183[label="1;1pkt 1fpkt"];
1668--2253[label="0.5;1pkt 1fpkt"];
1668--2564[label="1;2pkt 2fpkt"];
1668--2590[label="0.5;1pkt 1fpkt"];
1668--2809[label="0.5;1pkt 1fpkt"];
1668--2911[label="1;1pkt 1fpkt"];
1668--2966[label="0.5;1pkt 1fpkt"];
1668--2968[label="1;1pkt 1fpkt"];
1668--2995[label="1;1pkt 1fpkt"];
1668--3105[label="1;2pkt 2fpkt"];
1668--3190[label="1;1pkt 1fpkt"];
1668--3199[label="0.5;1pkt 1fpkt"];
1668--3277[label="0.214008;165pkt 165fpkt"];
1668--3281[label="0.507559;705pkt 705fpkt"];
1668--3286[label="0.161987;225pkt 225fpkt"];
1668--3291[label="0.214008;165pkt 165fpkt"];
1668--3300[label="0.214008;165pkt 165fpkt"];
1668--3797[label="1;5pkt 5fpkt"];
1669--2911[label="1;1pkt 1fpkt"];
1669--3797[label="1;1pkt 1fpkt"];
1787--3281[label="0.5;1pkt 1fpkt"];
1820--2809[label="1;2pkt 2fpkt"];
1820--3797[label="0.5;1pkt 1fpkt"];
1918--3190[label="1;1pkt 1fpkt"];
1918--3797[label="1;1pkt 1fpkt"];
2564--3105[label="1;2pkt 2fpkt"];
2564--3797[label="0.5;1pkt 1fpkt"];
2809--3797[label="0.5;1pkt 1fpkt"];
2911--3797[label="1;1pkt 1fpkt"];
3105--3797[label="0.5;1pkt 1fpkt"];
3190--3797[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="6257" src_ip="136.234.118.106" src_port="6257"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398824" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.834096,1.89544,503,1 1 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_588{
style=filled;
color=gray75;
446[label="61.238.203.161s;2pkt 2fpkt", shape=rectangle, color=red];
1042[label="61.238.203.161s;2pkt 2fpkt", shape=ellipse, color=green];
2444[label="144.52.35.161;s;68pkt 68fpkt", shape=diamond, color=yellow];
stat588[shape=component, label=&lt;Rules:&lt;BR/&gt;{144.52.35.161:*, 88.177.62.12:80}[26.087%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.6111%)&lt;BR/&gt; 1380: (2.08333%)&lt;BR/&gt; 2214: (1.38889%)&lt;BR/&gt; 25: (1.38889%)&lt;BR/&gt; 1449: (0.694444%)&gt;];
}
446--1042[label="1;2pkt 2fpkt"];
446--2185[label="0.5;1pkt 1fpkt"];
446--2444[label="0.5;1pkt 1fpkt"];
1042--2185[label="0.5;1pkt 1fpkt"];
1042--2444[label="0.5;1pkt 1fpkt"];
2444--2700[label="0.375;6pkt 6fpkt"];
2444--3022[label="0.0294118;2pkt 2fpkt"];
2444--3063[label="1;62pkt 62fpkt"];
2444--3092[label="0.0147059;1pkt 1fpkt"];
2444--3206[label="0.375;6pkt 6fpkt"];
2444--3279[label="0.0147059;1pkt 1fpkt"];
2444--3283[label="0.0294118;2pkt 2fpkt"];
2444--3294[label="0.0147059;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="88.177.62.12" dst_port="80" src_ip="144.52.35.161"/>
    </slice>
    <from sec="1041397910" usec="0"/>
    <to sec="1041398656" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.15425,1.87632,999,1 1 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_589{
style=filled;
color=gray75;
362[label="203.25.80.131s;81pkt 81fpkt", shape=rectangle, color=red];
976[label="203.25.80.131s;81pkt 81fpkt", shape=ellipse, color=green];
2204[label="203.11.163.34;d;22pkt 22fpkt", shape=diamond, color=yellow];
3921[label="90.222.52.131;15pkt 15fpkt", shape=pentagon, color=darkviolet];
4733[label="90.222.52.131;15pkt 15fpkt", shape=invtriangle, color=brown];
5160[label="90.222.52.131;15pkt 15fpkt", shape=invhouse, color=bisque];
stat589[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.25.80.131:1033, *:137}[68.1416%]&lt;BR/&gt;{*:*, *:53}[31.8584%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1033: (33.6245%)&lt;BR/&gt; 137: (33.6245%)&lt;BR/&gt; 53: (16.5939%)&lt;BR/&gt; 33701: (12.8821%)&lt;BR/&gt; 65534: (0.218341%)&gt;];
}
362--976[label="1;81pkt 81fpkt"];
362--1638[label="0.0123457;1pkt 1fpkt"];
362--1785[label="0.0123457;1pkt 1fpkt"];
362--2204[label="0.0454545;1pkt 1fpkt"];
362--2417[label="0.333333;1pkt 1fpkt"];
362--3010[label="0.0123457;1pkt 1fpkt"];
362--3274[label="0.0246914;2pkt 2fpkt"];
362--3278[label="0.037037;3pkt 3fpkt"];
362--3282[label="0.0246914;2pkt 2fpkt"];
362--3287[label="0.0123457;1pkt 1fpkt"];
362--3288[label="0.0246914;2pkt 2fpkt"];
362--3293[label="0.037037;3pkt 3fpkt"];
362--3296[label="0.0246914;2pkt 2fpkt"];
362--3297[label="0.0246914;2pkt 2fpkt"];
362--3921[label="0.266667;4pkt 4fpkt"];
362--4733[label="0.266667;4pkt 4fpkt"];
362--5160[label="0.266667;4pkt 4fpkt"];
976--1638[label="0.0123457;1pkt 1fpkt"];
976--1785[label="0.0123457;1pkt 1fpkt"];
976--2204[label="0.0454545;1pkt 1fpkt"];
976--2417[label="0.333333;1pkt 1fpkt"];
976--3010[label="0.0123457;1pkt 1fpkt"];
976--3274[label="0.0246914;2pkt 2fpkt"];
976--3278[label="0.037037;3pkt 3fpkt"];
976--3282[label="0.0246914;2pkt 2fpkt"];
976--3287[label="0.0123457;1pkt 1fpkt"];
976--3288[label="0.0246914;2pkt 2fpkt"];
976--3293[label="0.037037;3pkt 3fpkt"];
976--3296[label="0.0246914;2pkt 2fpkt"];
976--3297[label="0.0246914;2pkt 2fpkt"];
976--3921[label="0.266667;4pkt 4fpkt"];
976--4733[label="0.266667;4pkt 4fpkt"];
976--5160[label="0.266667;4pkt 4fpkt"];
2204--3278[label="0.272727;6pkt 6fpkt"];
2204--3282[label="0.272727;6pkt 6fpkt"];
2204--3293[label="0.272727;6pkt 6fpkt"];
2204--3296[label="0.272727;6pkt 6fpkt"];
2204--3921[label="0.0666667;1pkt 1fpkt"];
2204--4733[label="0.0666667;1pkt 1fpkt"];
2204--5160[label="0.0666667;1pkt 1fpkt"];
3921--4733[label="1;15pkt 15fpkt"];
3921--5160[label="1;15pkt 15fpkt"];
4733--5160[label="1;15pkt 15fpkt"];
</description>
    <slice>
      <filter dst_port="53"/>
      <filter dst_port="137" src_ip="203.25.80.131" src_port="1033"/>
    </slice>
    <from sec="1041397205" usec="0"/>
    <to sec="1041398822" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_590{
style=filled;
color=gray75;
1877[label="202.9.38.181;s;500pkt 500fpkt", shape=diamond, color=yellow];
2107[label="63.161.105.170;d;226pkt 226fpkt", shape=diamond, color=yellow];
2206[label="144.52.17.92;s;93pkt 93fpkt", shape=diamond, color=yellow];
2434[label="63.161.105.161;d;171pkt 171fpkt", shape=diamond, color=yellow];
3093[label="202.9.38.181;s;395pkt 395fpkt", shape=hexagon, color=black];
stat590[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.9.38.181:*, 63.161.105.170:80}[39.1231%]&lt;BR/&gt;{202.9.38.181:*, 63.161.105.161:80}[32.715%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (46.3177%)&lt;BR/&gt; 0: (2.59928%)&lt;BR/&gt; 53: (2.34657%)&lt;BR/&gt; 32787: (1.98556%)&lt;BR/&gt; 46782: (0.108303%)&gt;];
}
1877--2107[label="0.99115;224pkt 224fpkt"];
1877--2434[label="1;171pkt 171fpkt"];
1877--2460[label="0.0333333;3pkt 3fpkt"];
1877--2696[label="0.0428571;3pkt 3fpkt"];
1877--3093[label="1;395pkt 395fpkt"];
1877--3274[label="0.002;1pkt 1fpkt"];
1877--3278[label="0.024;12pkt 12fpkt"];
1877--3279[label="0.028;14pkt 14fpkt"];
1877--3282[label="0.012;6pkt 6fpkt"];
1877--3283[label="0.028;14pkt 14fpkt"];
1877--3284[label="0.004;2pkt 2fpkt"];
1877--3288[label="0.002;1pkt 1fpkt"];
1877--3293[label="0.024;12pkt 12fpkt"];
1877--3294[label="0.028;14pkt 14fpkt"];
1877--3296[label="0.012;6pkt 6fpkt"];
1877--3297[label="0.002;1pkt 1fpkt"];
2107--2206[label="0.0215054;2pkt 2fpkt"];
2107--3093[label="0.853982;193pkt 193fpkt"];
2107--3279[label="0.0132743;3pkt 3fpkt"];
2107--3283[label="0.0486726;11pkt 11fpkt"];
2107--3294[label="0.0132743;3pkt 3fpkt"];
2206--2243[label="0.714286;15pkt 15fpkt"];
2434--3093[label="0.730994;125pkt 125fpkt"];
2434--3279[label="0.0643275;11pkt 11fpkt"];
2434--3294[label="0.0643275;11pkt 11fpkt"];
3093--3274[label="0.00253165;1pkt 1fpkt"];
3093--3278[label="0.0227848;9pkt 9fpkt"];
3093--3279[label="0.0101266;4pkt 4fpkt"];
3093--3282[label="0.0151899;6pkt 6fpkt"];
3093--3288[label="0.00253165;1pkt 1fpkt"];
3093--3293[label="0.0227848;9pkt 9fpkt"];
3093--3294[label="0.0101266;4pkt 4fpkt"];
3093--3296[label="0.0151899;6pkt 6fpkt"];
3093--3297[label="0.00253165;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="63.161.105.170" dst_port="80" src_ip="202.9.38.181"/>
      <filter dst_ip="63.161.105.161" dst_port="80" src_ip="202.9.38.181"/>
    </slice>
    <from sec="1041397227" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757634,1.96858,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="136.234.119.35"/>
      <from sec="1041397200" usec="0"/>
      <to sec="1041398748" usec="0"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.09123,1.91892,999,1 1 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_592{
style=filled;
color=gray75;
657[label="4.131.115.169d;2pkt 2fpkt", shape=rectangle, color=red];
1205[label="4.131.115.169d;2pkt 2fpkt", shape=ellipse, color=green];
2223[label="210.224.215.169;d;1pkt 1fpkt", shape=diamond, color=yellow];
2953[label="210.224.215.169;d;1pkt 1fpkt", shape=hexagon, color=black];
stat592[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.119.19:1412, 210.224.215.169:1540}[50%]&lt;BR/&gt;{148.4.130.101:32773, 131.180.151.169:53}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1540: (33.3333%)&lt;BR/&gt; 1412: (33.3333%)&lt;BR/&gt; 32773: (16.6667%)&lt;BR/&gt; 53: (16.6667%)&gt;];
}
657--1205[label="1;2pkt 2fpkt"];
657--1774[label="0.5;1pkt 1fpkt"];
657--2223[label="1;1pkt 1fpkt"];
657--2231[label="0.5;1pkt 1fpkt"];
657--2865[label="0.5;1pkt 1fpkt"];
657--2953[label="1;1pkt 1fpkt"];
657--3130[label="0.5;1pkt 1fpkt"];
657--3780[label="0.5;1pkt 1fpkt"];
1205--1774[label="0.5;1pkt 1fpkt"];
1205--2223[label="1;1pkt 1fpkt"];
1205--2231[label="0.5;1pkt 1fpkt"];
1205--2865[label="0.5;1pkt 1fpkt"];
1205--2953[label="1;1pkt 1fpkt"];
1205--3130[label="0.5;1pkt 1fpkt"];
1205--3780[label="0.5;1pkt 1fpkt"];
2223--2865[label="1;1pkt 1fpkt"];
2223--2953[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="131.180.151.169" dst_port="53" src_ip="148.4.130.101" src_port="32773"/>
      <filter dst_ip="210.224.215.169" dst_port="1540" src_ip="136.234.119.19" src_port="1412"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757634,1.96858,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_593{
style=filled;
color=gray75;
2199[label="150.185.174.201;s;1pkt 1fpkt", shape=diamond, color=yellow];
2233[label="148.132.176.43;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat593[shape=component, label=&lt;Rules:&lt;BR/&gt;{150.185.174.201:3707, 148.132.176.43:10000}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 10000: (50%)&lt;BR/&gt; 3707: (50%)&gt;];
}
2199--2233[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="148.132.176.43" dst_port="10000" src_ip="150.185.174.201" src_port="3707"/>
    </slice>
    <from sec="1041397205" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757634,1.96858,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_595{
style=filled;
color=gray75;
2140[label="61.224.191.222;s;1pkt 1fpkt", shape=diamond, color=yellow];
2269[label="168.125.224.157;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat595[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.224.191.222:41820, 168.125.224.157:1347}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 41820: (50%)&lt;BR/&gt; 1347: (50%)&gt;];
}
2140--2269[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="168.125.224.157" dst_port="1347" src_ip="61.224.191.222" src_port="41820"/>
    </slice>
    <from sec="1041397201" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.873736,1.91329,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_596{
style=filled;
color=gray75;
2159[label="136.234.119.36;d;44pkt 44fpkt", shape=diamond, color=yellow];
2297[label="131.45.70.107;s;13pkt 13fpkt", shape=diamond, color=yellow];
3402[label="202.81.110.16;16pkt 16fpkt", shape=pentagon, color=darkviolet];
3801[label="131.45.70.107;19pkt 19fpkt", shape=pentagon, color=darkviolet];
4460[label="202.81.110.16;16pkt 16fpkt", shape=invtriangle, color=brown];
stat596[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.45.70.107:80, 136.234.119.36:*}[43.1818%]&lt;BR/&gt;{202.81.110.16:80, 136.234.119.36:*}[36.3636%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.6852%)&lt;BR/&gt; 8000: (1.38889%)&lt;BR/&gt; 1189: (1.38889%)&lt;BR/&gt; 1188: (1.38889%)&lt;BR/&gt; 1187: (1.38889%)&gt;];
}
2159--2297[label="1;13pkt 13fpkt"];
2159--3402[label="1;16pkt 16fpkt"];
2159--3801[label="1;19pkt 19fpkt"];
2159--4460[label="1;16pkt 16fpkt"];
2297--3801[label="1;13pkt 13fpkt"];
3402--4460[label="1;16pkt 16fpkt"];
</description>
    <slice>
      <filter dst_ip="136.234.119.36" src_ip="131.45.70.107" src_port="80"/>
      <filter dst_ip="136.234.119.36" src_ip="202.81.110.16" src_port="80"/>
    </slice>
    <from sec="1041397235" usec="0"/>
    <to sec="1041398808" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757634,1.96858,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_597{
style=filled;
color=gray75;
2299[label="148.155.247.8;s;1pkt 1fpkt", shape=diamond, color=yellow];
2300[label="63.119.66.202;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat597[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.155.247.8:80, 63.119.66.202:47209}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 47209: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
2299--2300[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="63.119.66.202" dst_port="47209" src_ip="148.155.247.8" src_port="80"/>
    </slice>
    <from sec="1041397723" usec="0"/>
    <to sec="1041398085" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.78132,1.88786,999,1 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_598{
style=filled;
color=gray75;
86[label="168.125.47.240d;1pkt 1fpkt", shape=rectangle, color=red];
2305[label="219.12.71.18;s;1pkt 1fpkt", shape=diamond, color=yellow];
3414[label="219.12.71.18;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat598[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.12.71.18:4662, 168.125.47.240:2070}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4662: (50%)&lt;BR/&gt; 2070: (50%)&gt;];
}
86--1648[label="1;1pkt 1fpkt"];
86--2305[label="1;1pkt 1fpkt"];
86--3414[label="1;1pkt 1fpkt"];
2305--3414[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="168.125.47.240" dst_port="2070" src_ip="219.12.71.18" src_port="4662"/>
    </slice>
    <from sec="1041397826" usec="0"/>
    <to sec="1041398170" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.18661,1.85795,999,1 1 1 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_599{
style=filled;
color=gray75;
195[label="217.91.88.46s;1pkt 1fpkt", shape=rectangle, color=red];
838[label="217.91.88.46s;1pkt 1fpkt", shape=ellipse, color=green];
1335[label="217.91.88.46s;1pkt 1fpkt", shape=triangle, color=blue];
2318[label="165.145.64.46;s;1pkt 1fpkt", shape=diamond, color=yellow];
3116[label="165.145.64.46;s;1pkt 1fpkt", shape=hexagon, color=black];
3549[label="165.145.64.46;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat599[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.145.64.46:4217, 148.155.246.77:6346}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6346: (50%)&lt;BR/&gt; 4217: (50%)&gt;];
}
195--838[label="1;1pkt 1fpkt"];
195--1335[label="1;1pkt 1fpkt"];
195--1628[label="1;1pkt 1fpkt"];
195--2318[label="1;1pkt 1fpkt"];
195--2726[label="1;1pkt 1fpkt"];
195--3116[label="1;1pkt 1fpkt"];
195--3213[label="1;1pkt 1fpkt"];
195--3549[label="1;1pkt 1fpkt"];
838--1335[label="1;1pkt 1fpkt"];
838--1628[label="1;1pkt 1fpkt"];
838--2318[label="1;1pkt 1fpkt"];
838--2726[label="1;1pkt 1fpkt"];
838--3116[label="1;1pkt 1fpkt"];
838--3213[label="1;1pkt 1fpkt"];
838--3549[label="1;1pkt 1fpkt"];
1335--1628[label="1;1pkt 1fpkt"];
1335--2318[label="1;1pkt 1fpkt"];
1335--2726[label="1;1pkt 1fpkt"];
1335--3116[label="1;1pkt 1fpkt"];
1335--3213[label="1;1pkt 1fpkt"];
1335--3549[label="1;1pkt 1fpkt"];
2318--2726[label="1;1pkt 1fpkt"];
2318--3116[label="1;1pkt 1fpkt"];
2318--3213[label="1;1pkt 1fpkt"];
2318--3549[label="1;1pkt 1fpkt"];
3116--3213[label="1;1pkt 1fpkt"];
3116--3549[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="148.155.246.77" dst_port="6346" src_ip="165.145.64.46" src_port="4217"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398822" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757634,1.96858,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="203.59.22.121"/>
      <from sec="1041397200" usec="0"/>
      <to sec="1041398747" usec="0"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398747" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.10027,1.95018,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_601{
style=filled;
color=gray75;
2363[label="203.59.18.91;s;3pkt 3fpkt", shape=diamond, color=yellow];
2364[label="90.199.83.113;d;1pkt 1fpkt", shape=diamond, color=yellow];
3737[label="203.59.18.91;2pkt 2fpkt", shape=pentagon, color=darkviolet];
4626[label="203.59.18.91;3pkt 3fpkt", shape=invtriangle, color=brown];
5107[label="203.59.18.91;2pkt 2fpkt", shape=invhouse, color=bisque];
stat601[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.59.18.91:65534, 209.242.232.36:53}[33.3333%]&lt;BR/&gt;{203.59.18.91:80, 90.199.83.113:64782}[33.3333%]&lt;BR/&gt;{203.59.18.91:65534, 63.138.57.186:53}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 65534: (36.3636%)&lt;BR/&gt; 53: (36.3636%)&lt;BR/&gt; 64782: (13.6364%)&lt;BR/&gt; 80: (13.6364%)&gt;];
}
2363--2364[label="1;1pkt 1fpkt"];
2363--3737[label="1;2pkt 2fpkt"];
2363--4626[label="1;3pkt 3fpkt"];
2363--5107[label="1;2pkt 2fpkt"];
2364--4626[label="1;1pkt 1fpkt"];
3737--4626[label="1;2pkt 2fpkt"];
3737--5107[label="1;2pkt 2fpkt"];
4626--5107[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="63.138.57.186" dst_port="53" src_ip="203.59.18.91" src_port="65534"/>
      <filter dst_ip="90.199.83.113" dst_port="64782" src_ip="203.59.18.91" src_port="80"/>
      <filter dst_ip="209.242.232.36" dst_port="53" src_ip="203.59.18.91" src_port="65534"/>
    </slice>
    <from sec="1041398025" usec="0"/>
    <to sec="1041398073" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.768632,1.92929,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_602{
style=filled;
color=gray75;
2362[label="203.59.18.91;d;2pkt 2fpkt", shape=diamond, color=yellow];
2365[label="90.199.83.113;s;2pkt 2fpkt", shape=diamond, color=yellow];
3828[label="90.199.83.113;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat602[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.242.232.36:53, 203.59.18.91:65534}[33.3333%]&lt;BR/&gt;{90.199.83.113:5724, 202.159.238.113:80}[33.3333%]&lt;BR/&gt;{90.199.83.113:64782, 203.59.18.91:80}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (40%)&lt;BR/&gt; 64782: (30%)&lt;BR/&gt; 65534: (10%)&lt;BR/&gt; 5724: (10%)&lt;BR/&gt; 53: (10%)&gt;];
}
2362--2365[label="0.5;1pkt 1fpkt"];
2362--3828[label="1;1pkt 1fpkt"];
2365--3828[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="203.59.18.91" dst_port="80" src_ip="90.199.83.113" src_port="64782"/>
      <filter dst_ip="202.159.238.113" dst_port="80" src_ip="90.199.83.113" src_port="5724"/>
      <filter dst_ip="203.59.18.91" dst_port="65534" src_ip="209.242.232.36" src_port="53"/>
    </slice>
    <from sec="1041398025" usec="0"/>
    <to sec="1041398408" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757634,1.96858,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="168.125.65.198"/>
      <from sec="1041397200" usec="0"/>
      <to sec="1041398717" usec="0"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398717" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.940809,1.83794,503,1 1 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_604{
style=filled;
color=gray75;
653[label="200.56.9.113d;1pkt 1fpkt", shape=rectangle, color=red];
1202[label="200.56.9.113d;1pkt 1fpkt", shape=ellipse, color=green];
2379[label="148.155.99.215;s;140pkt 140fpkt", shape=diamond, color=yellow];
4264[label="148.155.99.215;155pkt 155fpkt", shape=pentagon, color=darkviolet];
4921[label="148.155.99.215;155pkt 155fpkt", shape=invtriangle, color=brown];
stat604[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.155.99.215:*, *:80}[52.9032%]&lt;BR/&gt;{148.155.99.215:8000, *:*}[43.871%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (28.4292%)&lt;BR/&gt; 8000: (21.5708%)&lt;BR/&gt; 39623: (0.553097%)&lt;BR/&gt; 64652: (0.331858%)&lt;BR/&gt; 63764: (0.331858%)&gt;];
}
653--1202[label="1;1pkt 1fpkt"];
653--2379[label="1;1pkt 1fpkt"];
653--3279[label="1;1pkt 1fpkt"];
653--3294[label="1;1pkt 1fpkt"];
653--4264[label="1;1pkt 1fpkt"];
653--4921[label="1;1pkt 1fpkt"];
1202--2379[label="1;1pkt 1fpkt"];
1202--3279[label="1;1pkt 1fpkt"];
1202--3294[label="1;1pkt 1fpkt"];
1202--4264[label="1;1pkt 1fpkt"];
1202--4921[label="1;1pkt 1fpkt"];
2379--3275[label="0.0142857;2pkt 2fpkt"];
2379--3279[label="0.0428571;6pkt 6fpkt"];
2379--3283[label="0.0428571;6pkt 6fpkt"];
2379--3289[label="0.0142857;2pkt 2fpkt"];
2379--3294[label="0.0428571;6pkt 6fpkt"];
2379--3298[label="0.0142857;2pkt 2fpkt"];
2379--4264[label="1;140pkt 140fpkt"];
2379--4921[label="1;140pkt 140fpkt"];
4264--4921[label="1;155pkt 155fpkt"];
</description>
    <slice>
      <filter src_ip="148.155.99.215" src_port="8000"/>
      <filter dst_port="80" src_ip="148.155.99.215"/>
    </slice>
    <from sec="1041397214" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.04191,1.81684,002,1 1 1 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_605{
style=filled;
color=gray75;
467[label="70.182.85.174s;627pkt 627fpkt", shape=rectangle, color=red];
1057[label="70.182.85.174s;627pkt 627fpkt", shape=ellipse, color=green];
1492[label="70.182.85.174s;605pkt 605fpkt", shape=triangle, color=blue];
2405[label="70.182.85.174;s;637pkt 637fpkt", shape=diamond, color=yellow];
4120[label="70.182.85.174;637pkt 637fpkt", shape=pentagon, color=darkviolet];
4834[label="70.182.85.174;636pkt 636fpkt", shape=invtriangle, color=brown];
stat605[shape=component, label=&lt;Rules:&lt;BR/&gt;{70.182.85.174:1031, *:137}[99.843%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1031: (49.9602%)&lt;BR/&gt; 137: (49.9602%)&lt;BR/&gt; 2148: (0.0397984%)&lt;BR/&gt; 139: (0.0397984%)&gt;];
}
467--1057[label="1;627pkt 627fpkt"];
467--1492[label="1;605pkt 605fpkt"];
467--2405[label="1;627pkt 627fpkt"];
467--4120[label="1;627pkt 627fpkt"];
467--4834[label="0.998405;626pkt 626fpkt"];
1057--1492[label="1;605pkt 605fpkt"];
1057--2405[label="1;627pkt 627fpkt"];
1057--4120[label="1;627pkt 627fpkt"];
1057--4834[label="0.998405;626pkt 626fpkt"];
1492--2405[label="1;605pkt 605fpkt"];
1492--4120[label="1;605pkt 605fpkt"];
1492--4834[label="0.998347;604pkt 604fpkt"];
2405--4120[label="1;637pkt 637fpkt"];
2405--4834[label="1;636pkt 636fpkt"];
4120--4834[label="1;636pkt 636fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="70.182.85.174" src_port="1031"/>
    </slice>
    <from sec="1041398096" usec="0"/>
    <to sec="1041398208" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757634,1.96858,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="136.234.76.53"/>
      <from sec="1041397200" usec="0"/>
      <to sec="1041398748" usec="0"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.30601,1.97302,503,0 0 0 1 1 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_607{
style=filled;
color=gray75;
1741[label="148.155.61.104;d;284pkt 284fpkt", shape=diamond, color=yellow];
1773[label="88.185.132.92;s;4pkt 4fpkt", shape=diamond, color=yellow];
2074[label="148.155.54.163;d;146pkt 146fpkt", shape=diamond, color=yellow];
2187[label="90.14.20.154;s;170pkt 170fpkt", shape=diamond, color=yellow];
2308[label="216.204.11.127;s;6pkt 6fpkt", shape=diamond, color=yellow];
2332[label="144.52.42.80;d;106pkt 106fpkt", shape=diamond, color=yellow];
2816[label="148.155.61.104;d;134pkt 134fpkt", shape=hexagon, color=black];
3051[label="90.14.20.154;s;161pkt 161fpkt", shape=hexagon, color=black];
3409[label="90.199.82.17;73pkt 73fpkt", shape=pentagon, color=darkviolet];
3429[label="217.38.113.20;11pkt 11fpkt", shape=pentagon, color=darkviolet];
3741[label="88.185.132.92;3pkt 3fpkt", shape=pentagon, color=darkviolet];
3772[label="216.204.13.100;8pkt 8fpkt", shape=pentagon, color=darkviolet];
3790[label="90.199.83.104;13pkt 13fpkt", shape=pentagon, color=darkviolet];
3795[label="216.204.3.106;16pkt 16fpkt", shape=pentagon, color=darkviolet];
3892[label="216.204.11.127;6pkt 6fpkt", shape=pentagon, color=darkviolet];
4029[label="90.14.20.154;187pkt 187fpkt", shape=pentagon, color=darkviolet];
4072[label="88.75.39.163;20pkt 20fpkt", shape=pentagon, color=darkviolet];
4077[label="203.160.88.164;4pkt 4fpkt", shape=pentagon, color=darkviolet];
4132[label="202.27.87.178;39pkt 39fpkt", shape=pentagon, color=darkviolet];
4388[label="210.115.159.251;28pkt 28fpkt", shape=pentagon, color=darkviolet];
4397[label="210.115.159.255;26pkt 26fpkt", shape=pentagon, color=darkviolet];
4628[label="88.185.132.92;4pkt 4fpkt", shape=invtriangle, color=brown];
4645[label="216.204.13.100;8pkt 8fpkt", shape=invtriangle, color=brown];
4655[label="90.199.83.104;13pkt 13fpkt", shape=invtriangle, color=brown];
4660[label="216.204.3.106;16pkt 16fpkt", shape=invtriangle, color=brown];
4716[label="216.204.11.127;6pkt 6fpkt", shape=invtriangle, color=brown];
4790[label="90.14.20.154;187pkt 187fpkt", shape=invtriangle, color=brown];
4814[label="88.75.39.163;20pkt 20fpkt", shape=invtriangle, color=brown];
4841[label="202.27.87.178;39pkt 39fpkt", shape=invtriangle, color=brown];
4989[label="210.115.159.255;25pkt 25fpkt", shape=invtriangle, color=brown];
5109[label="88.185.132.92;4pkt 4fpkt", shape=invhouse, color=bisque];
5115[label="216.204.13.100;8pkt 8fpkt", shape=invhouse, color=bisque];
5123[label="216.204.3.106;16pkt 16fpkt", shape=invhouse, color=bisque];
5187[label="90.14.20.154;187pkt 187fpkt", shape=invhouse, color=bisque];
5189[label="216.204.28.155;2pkt 2fpkt", shape=invhouse, color=bisque];
5196[label="88.75.39.163;20pkt 20fpkt", shape=invhouse, color=bisque];
5207[label="202.27.87.178;39pkt 39fpkt", shape=invhouse, color=bisque];
5291[label="210.115.159.255;26pkt 26fpkt", shape=invhouse, color=bisque];
stat607[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 148.155.61.104:80}[36.0097%]&lt;BR/&gt;{90.14.20.154:*, *:80}[22.2628%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.9346%)&lt;BR/&gt; 3938: (0.605327%)&lt;BR/&gt; 53: (0.605327%)&lt;BR/&gt; 1188: (0.387409%)&lt;BR/&gt; 1210: (0.290557%)&gt;];
}
1741--1773[label="1;4pkt 4fpkt"];
1741--2187[label="0.270588;46pkt 46fpkt"];
1741--2308[label="1;6pkt 6fpkt"];
1741--2438[label="0.0149254;1pkt 1fpkt"];
1741--2486[label="0.0333333;1pkt 1fpkt"];
1741--2816[label="1;134pkt 134fpkt"];
1741--3051[label="0.273292;44pkt 44fpkt"];
1741--3096[label="0.0333333;1pkt 1fpkt"];
1741--3275[label="0.0352113;10pkt 10fpkt"];
1741--3279[label="0.0352113;10pkt 10fpkt"];
1741--3283[label="0.0246479;7pkt 7fpkt"];
1741--3289[label="0.0352113;10pkt 10fpkt"];
1741--3294[label="0.0352113;10pkt 10fpkt"];
1741--3298[label="0.0352113;10pkt 10fpkt"];
1741--3349[label="0.0142857;1pkt 1fpkt"];
1741--3409[label="0.0547945;4pkt 4fpkt"];
1741--3644[label="0.0210526;2pkt 2fpkt"];
1741--3660[label="0.0123457;1pkt 1fpkt"];
1741--3668[label="0.0267857;3pkt 3fpkt"];
1741--3741[label="1;3pkt 3fpkt"];
1741--3772[label="0.75;6pkt 6fpkt"];
1741--3790[label="0.307692;4pkt 4fpkt"];
1741--3795[label="0.25;4pkt 4fpkt"];
1741--3892[label="1;6pkt 6fpkt"];
1741--4029[label="0.245989;46pkt 46fpkt"];
1741--4066[label="0.0243902;1pkt 1fpkt"];
1741--4072[label="0.9;18pkt 18fpkt"];
1741--4077[label="0.75;3pkt 3fpkt"];
1741--4078[label="0.0153846;1pkt 1fpkt"];
1741--4081[label="0.00961538;1pkt 1fpkt"];
1741--4388[label="0.0357143;1pkt 1fpkt"];
1741--4397[label="0.769231;20pkt 20fpkt"];
1741--4588[label="0.0121951;1pkt 1fpkt"];
1741--4628[label="1;4pkt 4fpkt"];
1741--4645[label="0.75;6pkt 6fpkt"];
1741--4655[label="0.307692;4pkt 4fpkt"];
1741--4660[label="0.25;4pkt 4fpkt"];
1741--4716[label="1;6pkt 6fpkt"];
1741--4790[label="0.245989;46pkt 46fpkt"];
1741--4814[label="0.9;18pkt 18fpkt"];
1741--4989[label="0.8;20pkt 20fpkt"];
1741--5086[label="0.0123457;1pkt 1fpkt"];
1741--5109[label="1;4pkt 4fpkt"];
1741--5115[label="0.75;6pkt 6fpkt"];
1741--5123[label="0.25;4pkt 4fpkt"];
1741--5187[label="0.245989;46pkt 46fpkt"];
1741--5196[label="0.9;18pkt 18fpkt"];
1741--5291[label="0.769231;20pkt 20fpkt"];
1773--2816[label="1;4pkt 4fpkt"];
1773--3741[label="1;3pkt 3fpkt"];
1773--4628[label="1;4pkt 4fpkt"];
1773--5109[label="1;4pkt 4fpkt"];
2074--2526[label="0.0192308;1pkt 1fpkt"];
2074--3275[label="0.0547945;8pkt 8fpkt"];
2074--3279[label="0.0479452;7pkt 7fpkt"];
2074--3283[label="0.0410959;6pkt 6fpkt"];
2074--3284[label="0.0410959;6pkt 6fpkt"];
2074--3289[label="0.0547945;8pkt 8fpkt"];
2074--3294[label="0.0479452;7pkt 7fpkt"];
2074--3298[label="0.0547945;8pkt 8fpkt"];
2074--3409[label="0.0273973;2pkt 2fpkt"];
2074--3429[label="0.454545;5pkt 5fpkt"];
2074--3644[label="0.0105263;1pkt 1fpkt"];
2074--3660[label="0.0246914;2pkt 2fpkt"];
2074--3668[label="0.00892857;1pkt 1fpkt"];
2074--3710[label="0.0192308;1pkt 1fpkt"];
2074--3772[label="0.25;2pkt 2fpkt"];
2074--3790[label="0.153846;2pkt 2fpkt"];
2074--3795[label="0.0625;1pkt 1fpkt"];
2074--4077[label="0.25;1pkt 1fpkt"];
2074--4132[label="0.0512821;2pkt 2fpkt"];
2074--4388[label="0.142857;4pkt 4fpkt"];
2074--4397[label="0.0769231;2pkt 2fpkt"];
2074--4588[label="0.0243902;2pkt 2fpkt"];
2074--4613[label="0.0192308;1pkt 1fpkt"];
2074--4645[label="0.25;2pkt 2fpkt"];
2074--4655[label="0.153846;2pkt 2fpkt"];
2074--4660[label="0.0625;1pkt 1fpkt"];
2074--4841[label="0.0512821;2pkt 2fpkt"];
2074--4989[label="0.04;1pkt 1fpkt"];
2074--5086[label="0.0246914;2pkt 2fpkt"];
2074--5115[label="0.25;2pkt 2fpkt"];
2074--5123[label="0.0625;1pkt 1fpkt"];
2074--5207[label="0.0512821;2pkt 2fpkt"];
2074--5291[label="0.0769231;2pkt 2fpkt"];
2187--2228[label="0.00588235;1pkt 1fpkt"];
2187--2816[label="0.179104;24pkt 24fpkt"];
2187--2895[label="0.317647;54pkt 54fpkt"];
2187--3049[label="0.00588235;1pkt 1fpkt"];
2187--3051[label="1;161pkt 161fpkt"];
2187--3275[label="0.0352941;6pkt 6fpkt"];
2187--3278[label="0.00588235;1pkt 1fpkt"];
2187--3279[label="0.0235294;4pkt 4fpkt"];
2187--3282[label="0.00588235;1pkt 1fpkt"];
2187--3289[label="0.0352941;6pkt 6fpkt"];
2187--3293[label="0.00588235;1pkt 1fpkt"];
2187--3294[label="0.0235294;4pkt 4fpkt"];
2187--3296[label="0.00588235;1pkt 1fpkt"];
2187--3298[label="0.0352941;6pkt 6fpkt"];
2187--4029[label="0.994118;169pkt 169fpkt"];
2187--4790[label="0.994118;169pkt 169fpkt"];
2187--5187[label="0.994118;169pkt 169fpkt"];
2308--2816[label="0.5;3pkt 3fpkt"];
2308--3892[label="1;6pkt 6fpkt"];
2308--4716[label="1;6pkt 6fpkt"];
2332--2438[label="0.0149254;1pkt 1fpkt"];
2332--2998[label="1;101pkt 101fpkt"];
2332--3275[label="0.0754717;8pkt 8fpkt"];
2332--3279[label="0.0754717;8pkt 8fpkt"];
2332--3283[label="0.0188679;2pkt 2fpkt"];
2332--3284[label="0.0188679;2pkt 2fpkt"];
2332--3289[label="0.0754717;8pkt 8fpkt"];
2332--3294[label="0.0754717;8pkt 8fpkt"];
2332--3298[label="0.0754717;8pkt 8fpkt"];
2332--3409[label="0.0273973;2pkt 2fpkt"];
2332--3644[label="0.0105263;1pkt 1fpkt"];
2332--3695[label="0.0227273;1pkt 1fpkt"];
2332--4034[label="0.666667;2pkt 2fpkt"];
2332--4081[label="0.00961538;1pkt 1fpkt"];
2332--4132[label="0.0512821;2pkt 2fpkt"];
2332--4388[label="0.321429;9pkt 9fpkt"];
2332--4389[label="0.94;47pkt 47fpkt"];
2332--4794[label="0.666667;2pkt 2fpkt"];
2332--4841[label="0.0512821;2pkt 2fpkt"];
2332--5189[label="1;2pkt 2fpkt"];
2332--5207[label="0.0512821;2pkt 2fpkt"];
2816--3051[label="0.179104;24pkt 24fpkt"];
2816--3275[label="0.0746269;10pkt 10fpkt"];
2816--3279[label="0.0149254;2pkt 2fpkt"];
2816--3283[label="0.0149254;2pkt 2fpkt"];
2816--3289[label="0.0746269;10pkt 10fpkt"];
2816--3294[label="0.0149254;2pkt 2fpkt"];
2816--3298[label="0.0746269;10pkt 10fpkt"];
2816--3409[label="0.0547945;4pkt 4fpkt"];
2816--3660[label="0.0123457;1pkt 1fpkt"];
2816--3741[label="1;3pkt 3fpkt"];
2816--3772[label="0.75;6pkt 6fpkt"];
2816--3790[label="0.230769;3pkt 3fpkt"];
2816--3892[label="0.5;3pkt 3fpkt"];
2816--4029[label="0.179104;24pkt 24fpkt"];
2816--4072[label="0.55;11pkt 11fpkt"];
2816--4081[label="0.00961538;1pkt 1fpkt"];
2816--4397[label="0.307692;8pkt 8fpkt"];
2816--4588[label="0.0121951;1pkt 1fpkt"];
2816--4628[label="1;4pkt 4fpkt"];
2816--4645[label="0.75;6pkt 6fpkt"];
2816--4655[label="0.230769;3pkt 3fpkt"];
2816--4716[label="0.5;3pkt 3fpkt"];
2816--4790[label="0.179104;24pkt 24fpkt"];
2816--4814[label="0.55;11pkt 11fpkt"];
2816--4989[label="0.32;8pkt 8fpkt"];
2816--5086[label="0.0123457;1pkt 1fpkt"];
2816--5109[label="1;4pkt 4fpkt"];
2816--5115[label="0.75;6pkt 6fpkt"];
2816--5187[label="0.179104;24pkt 24fpkt"];
2816--5196[label="0.55;11pkt 11fpkt"];
2816--5291[label="0.307692;8pkt 8fpkt"];
3051--3275[label="0.0372671;6pkt 6fpkt"];
3051--3278[label="0.00621118;1pkt 1fpkt"];
3051--3279[label="0.0248447;4pkt 4fpkt"];
3051--3282[label="0.00621118;1pkt 1fpkt"];
3051--3289[label="0.0372671;6pkt 6fpkt"];
3051--3293[label="0.00621118;1pkt 1fpkt"];
3051--3294[label="0.0248447;4pkt 4fpkt"];
3051--3296[label="0.00621118;1pkt 1fpkt"];
3051--3298[label="0.0372671;6pkt 6fpkt"];
3051--4029[label="0.993789;160pkt 160fpkt"];
3051--4790[label="0.993789;160pkt 160fpkt"];
3051--5187[label="0.993789;160pkt 160fpkt"];
3741--4628[label="1;3pkt 3fpkt"];
3741--5109[label="1;3pkt 3fpkt"];
3772--4645[label="1;8pkt 8fpkt"];
3772--5115[label="1;8pkt 8fpkt"];
3790--4655[label="1;13pkt 13fpkt"];
3795--4660[label="1;16pkt 16fpkt"];
3795--5123[label="1;16pkt 16fpkt"];
3892--4716[label="1;6pkt 6fpkt"];
4029--4790[label="1;187pkt 187fpkt"];
4029--5187[label="1;187pkt 187fpkt"];
4072--4814[label="1;20pkt 20fpkt"];
4072--5196[label="1;20pkt 20fpkt"];
4132--4841[label="1;39pkt 39fpkt"];
4132--5207[label="1;39pkt 39fpkt"];
4397--4989[label="1;25pkt 25fpkt"];
4397--5291[label="1;26pkt 26fpkt"];
4628--5109[label="1;4pkt 4fpkt"];
4645--5115[label="1;8pkt 8fpkt"];
4660--5123[label="1;16pkt 16fpkt"];
4790--5187[label="1;187pkt 187fpkt"];
4814--5196[label="1;20pkt 20fpkt"];
4841--5207[label="1;39pkt 39fpkt"];
4989--5291[label="1;25pkt 25fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="90.14.20.154"/>
      <filter dst_ip="148.155.61.104" dst_port="80"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398822" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.17115,1.93992,999,0 1 1 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_608{
style=filled;
color=gray75;
897[label="203.102.150.88s;1pkt 1fpkt", shape=ellipse, color=green];
1376[label="203.102.150.88s;1pkt 1fpkt", shape=triangle, color=blue];
2397[label="144.52.66.88;s;1pkt 1fpkt", shape=diamond, color=yellow];
2445[label="89.83.161.82;d;1pkt 1fpkt", shape=diamond, color=yellow];
3099[label="144.52.66.88;s;1pkt 1fpkt", shape=hexagon, color=black];
stat608[shape=component, label=&lt;Rules:&lt;BR/&gt;{144.52.66.88:6699, 89.83.161.82:1541}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (50%)&lt;BR/&gt; 1541: (50%)&gt;];
}
897--1376[label="1;1pkt 1fpkt"];
897--2397[label="1;1pkt 1fpkt"];
897--2445[label="1;1pkt 1fpkt"];
897--3099[label="1;1pkt 1fpkt"];
1376--2397[label="1;1pkt 1fpkt"];
1376--2445[label="1;1pkt 1fpkt"];
1376--3099[label="1;1pkt 1fpkt"];
2397--2445[label="1;1pkt 1fpkt"];
2397--3099[label="1;1pkt 1fpkt"];
2445--3099[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="89.83.161.82" dst_port="1541" src_ip="144.52.66.88" src_port="6699"/>
    </slice>
    <from sec="1041397937" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757634,1.96858,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_609{
style=filled;
color=gray75;
2396[label="144.52.66.88;d;1pkt 1fpkt", shape=diamond, color=yellow];
2446[label="89.83.161.82;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat609[shape=component, label=&lt;Rules:&lt;BR/&gt;{89.83.161.82:1541, 144.52.66.88:6699}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (50%)&lt;BR/&gt; 1541: (50%)&gt;];
}
2396--2446[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="144.52.66.88" dst_port="6699" src_ip="89.83.161.82" src_port="1541"/>
    </slice>
    <from sec="1041397937" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757634,1.96858,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="93.132.182.13"/>
      <from sec="1041398262" usec="0"/>
      <to sec="1041398305" usec="0"/>
    </slice>
    <from sec="1041398262" usec="0"/>
    <to sec="1041398305" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.873736,1.91329,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_612{
style=filled;
color=gray75;
1690[label="136.234.170.208;d;291pkt 291fpkt", shape=diamond, color=yellow];
2501[label="217.21.160.5;s;7pkt 7fpkt", shape=diamond, color=yellow];
3339[label="217.21.160.5;10pkt 10fpkt", shape=pentagon, color=darkviolet];
3896[label="61.209.33.128;29pkt 29fpkt", shape=pentagon, color=darkviolet];
3977[label="61.213.21.141;29pkt 29fpkt", shape=pentagon, color=darkviolet];
4249[label="61.209.33.212;21pkt 21fpkt", shape=pentagon, color=darkviolet];
4395[label="217.56.18.255;45pkt 45fpkt", shape=pentagon, color=darkviolet];
4423[label="217.21.160.5;11pkt 11fpkt", shape=invtriangle, color=brown];
4717[label="61.209.33.128;29pkt 29fpkt", shape=invtriangle, color=brown];
4911[label="61.209.33.212;20pkt 20fpkt", shape=invtriangle, color=brown];
stat612[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.209.33.165:80, 136.234.170.208:*}[20.4082%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.0854%)&lt;BR/&gt; 443: (0.914634%)&lt;BR/&gt; 1757: (0.406504%)&lt;BR/&gt; 1756: (0.406504%)&lt;BR/&gt; 1687: (0.406504%)&gt;];
}
1690--2407[label="1;8pkt 8fpkt"];
1690--2501[label="1;7pkt 7fpkt"];
1690--3031[label="1;4pkt 4fpkt"];
1690--3339[label="0.7;7pkt 7fpkt"];
1690--3378[label="0.578947;11pkt 11fpkt"];
1690--3535[label="1;8pkt 8fpkt"];
1690--3896[label="0.965517;28pkt 28fpkt"];
1690--3977[label="0.0344828;1pkt 1fpkt"];
1690--4249[label="0.0952381;2pkt 2fpkt"];
1690--4395[label="1;45pkt 45fpkt"];
1690--4423[label="0.636364;7pkt 7fpkt"];
1690--4446[label="0.611111;11pkt 11fpkt"];
1690--4528[label="1;7pkt 7fpkt"];
1690--4717[label="0.965517;28pkt 28fpkt"];
1690--4911[label="0.1;2pkt 2fpkt"];
1690--5010[label="0.611111;11pkt 11fpkt"];
2501--3339[label="1;7pkt 7fpkt"];
2501--4423[label="1;7pkt 7fpkt"];
3339--4423[label="1;10pkt 10fpkt"];
3896--4717[label="1;29pkt 29fpkt"];
4249--4911[label="1;20pkt 20fpkt"];
</description>
    <slice>
      <filter dst_ip="136.234.170.208" src_ip="61.209.33.165" src_port="80"/>
    </slice>
    <from sec="1041397225" usec="0"/>
    <to sec="1041398797" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757634,1.96858,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="192.128.206.134"/>
      <from sec="1041397200" usec="0"/>
      <to sec="1041398746" usec="0"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398746" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757634,1.96858,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="144.52.128.210"/>
      <from sec="1041397200" usec="0"/>
      <to sec="1041398748" usec="0"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.834096,1.89544,999,1 1 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_615{
style=filled;
color=gray75;
537[label="88.24.106.217s;1pkt 1fpkt", shape=rectangle, color=red];
1109[label="88.24.106.217s;1pkt 1fpkt", shape=ellipse, color=green];
2518[label="202.20.18.217;s;156pkt 156fpkt", shape=diamond, color=yellow];
stat615[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.20.18.217:53, *:53}[29.4872%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (64.557%)&lt;BR/&gt; 32781: (0.949367%)&lt;BR/&gt; 32776: (0.949367%)&lt;BR/&gt; 32773: (0.949367%)&lt;BR/&gt; 1024: (0.949367%)&gt;];
}
537--1109[label="1;1pkt 1fpkt"];
537--2518[label="1;1pkt 1fpkt"];
1109--2518[label="1;1pkt 1fpkt"];
2518--3274[label="0.0128205;2pkt 2fpkt"];
2518--3278[label="0.0705128;11pkt 11fpkt"];
2518--3282[label="0.0512821;8pkt 8fpkt"];
2518--3288[label="0.0128205;2pkt 2fpkt"];
2518--3293[label="0.0705128;11pkt 11fpkt"];
2518--3296[label="0.0512821;8pkt 8fpkt"];
2518--3297[label="0.0128205;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_port="53" src_ip="202.20.18.217" src_port="53"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398746" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_616{
style=filled;
color=gray75;
557[label="211.219.70.225s;100pkt 100fpkt", shape=rectangle, color=red];
1124[label="211.219.70.225s;100pkt 100fpkt", shape=ellipse, color=green];
1542[label="211.219.70.225s;100pkt 100fpkt", shape=triangle, color=blue];
4305[label="211.219.70.225;103pkt 103fpkt", shape=pentagon, color=darkviolet];
stat616[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.219.70.225:1890, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1890: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
557--1124[label="1;100pkt 100fpkt"];
557--1542[label="1;100pkt 100fpkt"];
557--2520[label="0.0384615;1pkt 1fpkt"];
557--3280[label="0.34;34pkt 34fpkt"];
557--3295[label="0.34;34pkt 34fpkt"];
557--4305[label="1;100pkt 100fpkt"];
1124--1542[label="1;100pkt 100fpkt"];
1124--2520[label="0.0384615;1pkt 1fpkt"];
1124--3280[label="0.34;34pkt 34fpkt"];
1124--3295[label="0.34;34pkt 34fpkt"];
1124--4305[label="1;100pkt 100fpkt"];
1542--2520[label="0.0384615;1pkt 1fpkt"];
1542--3280[label="0.34;34pkt 34fpkt"];
1542--3295[label="0.34;34pkt 34fpkt"];
1542--4305[label="1;100pkt 100fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="211.219.70.225" src_port="1890"/>
    </slice>
    <from sec="1041398449" usec="0"/>
    <to sec="1041398466" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757634,1.96858,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_617{
style=filled;
color=gray75;
2457[label="148.155.246.98;d;1pkt 1fpkt", shape=diamond, color=yellow];
2521[label="70.11.208.157;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat617[shape=component, label=&lt;Rules:&lt;BR/&gt;{70.11.208.157:3916, 148.155.246.98:6699}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (50%)&lt;BR/&gt; 3916: (50%)&gt;];
}
2457--2521[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="148.155.246.98" dst_port="6699" src_ip="70.11.208.157" src_port="3916"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757634,1.96858,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="144.52.136.10"/>
      <from sec="1041397246" usec="0"/>
      <to sec="1041398699" usec="0"/>
    </slice>
    <from sec="1041397246" usec="0"/>
    <to sec="1041398699" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.768632,1.92929,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_619{
style=filled;
color=gray75;
1713[label="202.159.194.17;d;1593pkt 1593fpkt", shape=diamond, color=yellow];
2066[label="205.119.50.215;s;1pkt 1fpkt", shape=diamond, color=yellow];
2385[label="219.96.185.185;s;1pkt 1fpkt", shape=diamond, color=yellow];
2388[label="90.200.192.52;s;1pkt 1fpkt", shape=diamond, color=yellow];
2627[label="218.159.151.165;s;124pkt 124fpkt", shape=diamond, color=yellow];
3728[label="4.208.134.88;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3773[label="70.144.77.100;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3888[label="219.148.76.126;3pkt 3fpkt", shape=pentagon, color=darkviolet];
4261[label="205.119.50.215;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat619[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:4662, 202.159.194.17:*}[77.2595%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4662: (38.4994%)&lt;BR/&gt; 80: (6.25724%)&lt;BR/&gt; 4661: (1.21669%)&lt;BR/&gt; 4663: (0.376593%)&lt;BR/&gt; 4665: (0.23175%)&gt;];
}
1713--2040[label="0.00326797;1pkt 1fpkt"];
1713--2045[label="0.0118694;4pkt 4fpkt"];
1713--2056[label="0.00934579;3pkt 3fpkt"];
1713--2062[label="0.0123839;4pkt 4fpkt"];
1713--2066[label="1;1pkt 1fpkt"];
1713--2088[label="0.012987;4pkt 4fpkt"];
1713--2139[label="0.00343643;1pkt 1fpkt"];
1713--2237[label="0.02;4pkt 4fpkt"];
1713--2315[label="0.0128755;3pkt 3fpkt"];
1713--2385[label="1;1pkt 1fpkt"];
1713--2388[label="1;1pkt 1fpkt"];
1713--2546[label="1;1pkt 1fpkt"];
1713--2627[label="0.016129;2pkt 2fpkt"];
1713--2641[label="0.025641;3pkt 3fpkt"];
1713--2842[label="0.00983607;3pkt 3fpkt"];
1713--2888[label="0.0131579;4pkt 4fpkt"];
1713--2960[label="0.02;4pkt 4fpkt"];
1713--2973[label="0.00471698;1pkt 1fpkt"];
1713--3128[label="0.014652;4pkt 4fpkt"];
1713--3161[label="0.0294118;3pkt 3fpkt"];
1713--3174[label="1;2pkt 2fpkt"];
1713--3504[label="0.0124611;4pkt 4fpkt"];
1713--3586[label="0.333333;1pkt 1fpkt"];
1713--3595[label="0.583333;7pkt 7fpkt"];
1713--3728[label="1;1pkt 1fpkt"];
1713--3773[label="1;1pkt 1fpkt"];
1713--3869[label="0.25;1pkt 1fpkt"];
1713--3888[label="1;3pkt 3fpkt"];
1713--3948[label="0.0112994;4pkt 4fpkt"];
1713--3963[label="0.0113636;4pkt 4fpkt"];
1713--4086[label="0.0234375;3pkt 3fpkt"];
1713--4140[label="0.0195122;4pkt 4fpkt"];
1713--4175[label="0.0277778;1pkt 1fpkt"];
1713--4261[label="1;1pkt 1fpkt"];
1713--4509[label="0.0125;4pkt 4fpkt"];
1713--4514[label="0.012931;3pkt 3fpkt"];
1713--4555[label="0.333333;1pkt 1fpkt"];
1713--4750[label="0.0112994;4pkt 4fpkt"];
1713--4818[label="0.0234375;3pkt 3fpkt"];
1713--4866[label="0.0285714;1pkt 1fpkt"];
1713--5045[label="0.0125;4pkt 4fpkt"];
1713--5200[label="0.0232558;3pkt 3fpkt"];
1713--5217[label="0.0555556;2pkt 2fpkt"];
2627--2729[label="0.201613;25pkt 25fpkt"];
2627--3265[label="0.201613;25pkt 25fpkt"];
</description>
    <slice>
      <filter dst_ip="202.159.194.17" src_port="4662"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.946667,1.87498,503,1 1 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_620{
style=filled;
color=gray75;
23[label="202.221.26.42s;1pkt 1fpkt", shape=rectangle, color=red];
717[label="202.221.26.42s;1pkt 1fpkt", shape=ellipse, color=green];
1330[label="70.96.138.42s;2pkt 2fpkt", shape=triangle, color=blue];
2549[label="202.221.26.42;s;2pkt 2fpkt", shape=diamond, color=yellow];
stat620[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.135.90.42:5121, 202.145.26.205:1361}[33.3333%]&lt;BR/&gt;{202.221.26.42:80, 168.125.224.25:3122}[33.3333%]&lt;BR/&gt;{202.221.26.42:80, 168.125.224.25:4984}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (41.6667%)&lt;BR/&gt; 4984: (33.3333%)&lt;BR/&gt; 5121: (8.33333%)&lt;BR/&gt; 3122: (8.33333%)&lt;BR/&gt; 1361: (8.33333%)&gt;];
}
23--717[label="1;1pkt 1fpkt"];
23--1330[label="1;1pkt 1fpkt"];
23--2033[label="1;1pkt 1fpkt"];
23--2549[label="1;1pkt 1fpkt"];
23--2834[label="1;1pkt 1fpkt"];
23--3259[label="1;1pkt 1fpkt"];
717--1330[label="1;1pkt 1fpkt"];
717--2033[label="1;1pkt 1fpkt"];
717--2549[label="1;1pkt 1fpkt"];
717--2834[label="1;1pkt 1fpkt"];
717--3259[label="1;1pkt 1fpkt"];
1330--1815[label="0.5;1pkt 1fpkt"];
1330--2033[label="0.5;1pkt 1fpkt"];
1330--2549[label="0.5;1pkt 1fpkt"];
1330--2602[label="0.5;1pkt 1fpkt"];
1330--2834[label="0.5;1pkt 1fpkt"];
1330--3140[label="0.5;1pkt 1fpkt"];
1330--3259[label="0.5;1pkt 1fpkt"];
1330--5054[label="0.5;1pkt 1fpkt"];
2549--2834[label="1;2pkt 2fpkt"];
2549--3259[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="168.125.224.25" dst_port="4984" src_ip="202.221.26.42" src_port="80"/>
      <filter dst_ip="168.125.224.25" dst_port="3122" src_ip="202.221.26.42" src_port="80"/>
      <filter dst_ip="202.145.26.205" dst_port="1361" src_ip="61.135.90.42" src_port="5121"/>
    </slice>
    <from sec="1041398226" usec="0"/>
    <to sec="1041398490" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.768632,1.92929,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_622{
style=filled;
color=gray75;
2138[label="172.142.141.216;s;152pkt 152fpkt", shape=diamond, color=yellow];
4270[label="172.142.141.216;165pkt 165fpkt", shape=pentagon, color=darkviolet];
stat622[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.142.141.216:*, *:25}[88.4848%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (45.4259%)&lt;BR/&gt; 113: (4.57413%)&lt;BR/&gt; 57306: (0.315457%)&lt;BR/&gt; 53628: (0.315457%)&lt;BR/&gt; 51868: (0.315457%)&gt;];
}
2138--2566[label="1;1pkt 1fpkt"];
2138--4270[label="1;152pkt 152fpkt"];
</description>
    <slice>
      <filter dst_port="25" src_ip="172.142.141.216"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398708" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757634,1.96858,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="202.159.195.92"/>
      <from sec="1041397200" usec="0"/>
      <to sec="1041398748" usec="0"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.30601,1.97302,503,0 0 0 1 1 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_625{
style=filled;
color=gray75;
1904[label="203.59.18.87;s;196pkt 196fpkt", shape=diamond, color=yellow];
2048[label="89.149.161.231;d;108pkt 108fpkt", shape=diamond, color=yellow];
2807[label="203.59.18.87;s;148pkt 148fpkt", shape=hexagon, color=black];
3718[label="203.59.18.87;211pkt 211fpkt", shape=pentagon, color=darkviolet];
4616[label="203.59.18.87;212pkt 212fpkt", shape=invtriangle, color=brown];
5101[label="203.59.18.87;212pkt 212fpkt", shape=invhouse, color=bisque];
stat625[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.59.18.87:80, 89.149.161.231:*}[55.1887%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (37.2125%)&lt;BR/&gt; 53: (9.8896%)&lt;BR/&gt; 3312: (6.99172%)&lt;BR/&gt; 25: (2.71389%)&lt;BR/&gt; 60888: (0.275989%)&gt;];
}
1904--2048[label="1;108pkt 108fpkt"];
1904--2584[label="0.0625;1pkt 1fpkt"];
1904--2585[label="0.0212766;1pkt 1fpkt"];
1904--2807[label="1;148pkt 148fpkt"];
1904--3274[label="0.0153061;3pkt 3fpkt"];
1904--3278[label="0.00510204;1pkt 1fpkt"];
1904--3282[label="0.0153061;3pkt 3fpkt"];
1904--3288[label="0.0153061;3pkt 3fpkt"];
1904--3293[label="0.00510204;1pkt 1fpkt"];
1904--3296[label="0.0153061;3pkt 3fpkt"];
1904--3297[label="0.0153061;3pkt 3fpkt"];
1904--3718[label="0.994898;195pkt 195fpkt"];
1904--4616[label="1;196pkt 196fpkt"];
1904--5101[label="1;196pkt 196fpkt"];
2048--2807[label="0.768519;83pkt 83fpkt"];
2048--3718[label="1;108pkt 108fpkt"];
2048--4616[label="1;108pkt 108fpkt"];
2048--5101[label="1;108pkt 108fpkt"];
2807--3274[label="0.0202703;3pkt 3fpkt"];
2807--3278[label="0.00675676;1pkt 1fpkt"];
2807--3282[label="0.00675676;1pkt 1fpkt"];
2807--3288[label="0.0202703;3pkt 3fpkt"];
2807--3293[label="0.00675676;1pkt 1fpkt"];
2807--3296[label="0.00675676;1pkt 1fpkt"];
2807--3297[label="0.0202703;3pkt 3fpkt"];
2807--3718[label="0.993243;147pkt 147fpkt"];
2807--4616[label="1;148pkt 148fpkt"];
2807--5101[label="1;148pkt 148fpkt"];
3718--4616[label="1;211pkt 211fpkt"];
3718--5101[label="1;211pkt 211fpkt"];
4616--5101[label="1;212pkt 212fpkt"];
</description>
    <slice>
      <filter dst_ip="89.149.161.231" src_ip="203.59.18.87" src_port="80"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398813" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.04343,1.95109,999,1 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_626{
style=filled;
color=gray75;
176[label="136.234.119.35s;1pkt 1fpkt", shape=rectangle, color=red];
1796[label="136.234.119.35;s;303pkt 303fpkt", shape=diamond, color=yellow];
2155[label="195.233.187.120;d;1pkt 1fpkt", shape=diamond, color=yellow];
2529[label="4.200.168.46;d;1pkt 1fpkt", shape=diamond, color=yellow];
2530[label="70.97.157.150;d;1pkt 1fpkt", shape=diamond, color=yellow];
2531[label="212.77.62.83;d;1pkt 1fpkt", shape=diamond, color=yellow];
2576[label="216.62.51.124;d;1pkt 1fpkt", shape=diamond, color=yellow];
2587[label="71.232.173.184;d;1pkt 1fpkt", shape=diamond, color=yellow];
2588[label="219.40.94.227;d;1pkt 1fpkt", shape=diamond, color=yellow];
2804[label="136.234.119.35;s;76pkt 76fpkt", shape=hexagon, color=black];
2959[label="195.233.187.120;d;1pkt 1fpkt", shape=hexagon, color=black];
3197[label="4.200.168.46;d;1pkt 1fpkt", shape=hexagon, color=black];
3198[label="70.97.157.150;d;1pkt 1fpkt", shape=hexagon, color=black];
stat626[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.119.35:4662, *:*}[72.2772%]&lt;BR/&gt;{136.234.119.35:1951, *:*}[20.132%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4662: (39.359%)&lt;BR/&gt; 1951: (9.87179%)&lt;BR/&gt; 4665: (7.82051%)&lt;BR/&gt; 4246: (0.641026%)&lt;BR/&gt; 63129: (0.512821%)&gt;];
}
176--1796[label="1;1pkt 1fpkt"];
176--2588[label="1;1pkt 1fpkt"];
176--2804[label="1;1pkt 1fpkt"];
1796--2155[label="1;1pkt 1fpkt"];
1796--2529[label="1;1pkt 1fpkt"];
1796--2530[label="1;1pkt 1fpkt"];
1796--2531[label="1;1pkt 1fpkt"];
1796--2576[label="1;1pkt 1fpkt"];
1796--2587[label="1;1pkt 1fpkt"];
1796--2588[label="1;1pkt 1fpkt"];
1796--2804[label="1;76pkt 76fpkt"];
1796--2959[label="1;1pkt 1fpkt"];
1796--3197[label="1;1pkt 1fpkt"];
1796--3198[label="1;1pkt 1fpkt"];
2155--2804[label="1;1pkt 1fpkt"];
2155--2959[label="1;1pkt 1fpkt"];
2529--2804[label="1;1pkt 1fpkt"];
2529--3197[label="1;1pkt 1fpkt"];
2530--2804[label="1;1pkt 1fpkt"];
2530--3198[label="1;1pkt 1fpkt"];
2531--2804[label="1;1pkt 1fpkt"];
2576--2804[label="1;1pkt 1fpkt"];
2587--2804[label="1;1pkt 1fpkt"];
2588--2804[label="1;1pkt 1fpkt"];
2804--2959[label="1;1pkt 1fpkt"];
2804--3197[label="1;1pkt 1fpkt"];
2804--3198[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="136.234.119.35" src_port="4662"/>
      <filter src_ip="136.234.119.35" src_port="1951"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398819" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.768632,1.92929,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_627{
style=filled;
color=gray75;
2463[label="202.159.194.67;d;221pkt 221fpkt", shape=diamond, color=yellow];
2600[label="209.107.20.180;s;8pkt 8fpkt", shape=diamond, color=yellow];
4266[label="202.86.202.215;103pkt 103fpkt", shape=pentagon, color=darkviolet];
stat627[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:53, 202.159.194.67:1086}[57.1429%]&lt;BR/&gt;{202.86.202.215:*, *:80}[32.6984%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (27.5602%)&lt;BR/&gt; 1086: (27.259%)&lt;BR/&gt; 80: (18.9759%)&lt;BR/&gt; 0: (6.92771%)&lt;BR/&gt; 2508: (0.301205%)&gt;];
}
2463--2600[label="0.125;1pkt 1fpkt"];
2463--3769[label="0.142857;1pkt 1fpkt"];
2463--3935[label="0.0454545;1pkt 1fpkt"];
2463--4125[label="0.0833333;1pkt 1fpkt"];
2463--4266[label="0.15534;16pkt 16fpkt"];
2463--4838[label="0.0833333;1pkt 1fpkt"];
2600--2724[label="0.875;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="202.86.202.215"/>
      <filter dst_ip="202.159.194.67" dst_port="1086" src_port="53"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398822" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757634,1.96858,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_628{
style=filled;
color=gray75;
2622[label="168.125.225.205;s;3pkt 3fpkt", shape=diamond, color=yellow];
2623[label="89.27.246.166;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat628[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.125.225.205:1040, 89.27.246.166:6669}[33.3333%]&lt;BR/&gt;{168.125.225.205:1048, 90.14.41.51:80}[33.3333%]&lt;BR/&gt;{168.125.225.205:1052, 90.14.41.51:80}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6669: (25%)&lt;BR/&gt; 1040: (25%)&lt;BR/&gt; 80: (25%)&lt;BR/&gt; 1052: (12.5%)&lt;BR/&gt; 1048: (12.5%)&gt;];
}
2622--2623[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="90.14.41.51" dst_port="80" src_ip="168.125.225.205" src_port="1052"/>
      <filter dst_ip="90.14.41.51" dst_port="80" src_ip="168.125.225.205" src_port="1048"/>
      <filter dst_ip="89.27.246.166" dst_port="6669" src_ip="168.125.225.205" src_port="1040"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398743" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757634,1.96858,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_629{
style=filled;
color=gray75;
2621[label="168.125.225.205;d;3pkt 3fpkt", shape=diamond, color=yellow];
2624[label="89.27.246.166;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat629[shape=component, label=&lt;Rules:&lt;BR/&gt;{89.27.246.166:6669, 168.125.225.205:1040}[33.3333%]&lt;BR/&gt;{90.14.41.51:80, 168.125.225.205:1048}[33.3333%]&lt;BR/&gt;{90.14.41.51:80, 168.125.225.205:1052}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6669: (25%)&lt;BR/&gt; 1040: (25%)&lt;BR/&gt; 80: (25%)&lt;BR/&gt; 1052: (12.5%)&lt;BR/&gt; 1048: (12.5%)&gt;];
}
2621--2624[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="168.125.225.205" dst_port="1052" src_ip="90.14.41.51" src_port="80"/>
      <filter dst_ip="168.125.225.205" dst_port="1048" src_ip="90.14.41.51" src_port="80"/>
      <filter dst_ip="168.125.225.205" dst_port="1040" src_ip="89.27.246.166" src_port="6669"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398743" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757634,1.96858,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_630{
style=filled;
color=gray75;
2630[label="4.18.31.73;d;1pkt 1fpkt", shape=diamond, color=yellow];
2631[label="136.234.32.151;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat630[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.32.151:1703, 4.18.31.73:6699}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (50%)&lt;BR/&gt; 1703: (50%)&gt;];
}
2630--2631[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="4.18.31.73" dst_port="6699" src_ip="136.234.32.151" src_port="1703"/>
    </slice>
    <from sec="1041397202" usec="0"/>
    <to sec="1041398743" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757634,1.96858,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="136.234.78.233"/>
      <from sec="1041397211" usec="0"/>
      <to sec="1041398639" usec="0"/>
    </slice>
    <from sec="1041397211" usec="0"/>
    <to sec="1041398639" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757634,1.96858,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="192.229.192.144"/>
      <from sec="1041397229" usec="0"/>
      <to sec="1041398748" usec="0"/>
    </slice>
    <from sec="1041397229" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,501,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_634{
style=filled;
color=gray75;
2598[label="62.118.133.24;d;2pkt 2fpkt", shape=diamond, color=yellow];
2648[label="168.125.25.52;s;3pkt 3fpkt", shape=diamond, color=yellow];
3172[label="168.125.25.52;s;3pkt 3fpkt", shape=hexagon, color=black];
stat634[shape=component, label=&lt;Rules:&lt;BR/&gt;{144.52.216.208:21, 62.118.133.24:1601}[25%]&lt;BR/&gt;{168.125.25.52:21, 213.4.168.73:1032}[25%]&lt;BR/&gt;{168.125.25.52:21, 213.22.112.145:2824}[25%]&lt;BR/&gt;{168.125.25.52:21, 62.118.133.24:1593}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (50%)&lt;BR/&gt; 1593: (18.75%)&lt;BR/&gt; 2824: (12.5%)&lt;BR/&gt; 1032: (12.5%)&lt;BR/&gt; 1601: (6.25%)&gt;];
}
2598--2648[label="0.5;1pkt 1fpkt"];
2598--2699[label="0.5;1pkt 1fpkt"];
2598--3172[label="0.5;1pkt 1fpkt"];
2648--3172[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="62.118.133.24" dst_port="1593" src_ip="168.125.25.52" src_port="21"/>
      <filter dst_ip="213.22.112.145" dst_port="2824" src_ip="168.125.25.52" src_port="21"/>
      <filter dst_ip="213.4.168.73" dst_port="1032" src_ip="168.125.25.52" src_port="21"/>
      <filter dst_ip="62.118.133.24" dst_port="1601" src_ip="144.52.216.208" src_port="21"/>
    </slice>
    <from sec="1041397906" usec="0"/>
    <to sec="1041398747" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.10917,1.9092,999,1 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_635{
style=filled;
color=gray75;
119[label="4.28.18.10s;1pkt 1fpkt", shape=rectangle, color=red];
1648[label="168.125.47.240;d;377pkt 377fpkt", shape=diamond, color=yellow];
1842[label="70.115.138.95;s;4pkt 4fpkt", shape=diamond, color=yellow];
1966[label="219.148.75.77;s;2pkt 2fpkt", shape=diamond, color=yellow];
2307[label="4.22.13.138;s;1pkt 1fpkt", shape=diamond, color=yellow];
2553[label="62.131.241.10;s;1pkt 1fpkt", shape=diamond, color=yellow];
2560[label="71.233.240.249;s;1pkt 1fpkt", shape=diamond, color=yellow];
2658[label="90.93.114.10;s;1pkt 1fpkt", shape=diamond, color=yellow];
3370[label="62.131.241.10;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3679[label="219.148.75.77;4pkt 4fpkt", shape=pentagon, color=darkviolet];
4442[label="62.131.241.10;1pkt 1fpkt", shape=invtriangle, color=brown];
4981[label="71.233.240.249;1pkt 1fpkt", shape=invtriangle, color=brown];
5008[label="62.131.241.10;1pkt 1fpkt", shape=invhouse, color=bisque];
5288[label="71.233.240.249;1pkt 1fpkt", shape=invhouse, color=bisque];
stat635[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:4662, 168.125.47.240:*}[66.3185%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4662: (41.8136%)&lt;BR/&gt; 4661: (1.63728%)&lt;BR/&gt; 6346: (1.25945%)&lt;BR/&gt; 0: (1.25945%)&lt;BR/&gt; 80: (0.755668%)&gt;];
}
119--1648[label="1;1pkt 1fpkt"];
119--2658[label="1;1pkt 1fpkt"];
1648--1727[label="1;1pkt 1fpkt"];
1648--1842[label="0.25;1pkt 1fpkt"];
1648--1897[label="1;1pkt 1fpkt"];
1648--1966[label="1;2pkt 2fpkt"];
1648--2304[label="1;2pkt 2fpkt"];
1648--2305[label="1;1pkt 1fpkt"];
1648--2307[label="1;1pkt 1fpkt"];
1648--2508[label="1;1pkt 1fpkt"];
1648--2553[label="1;1pkt 1fpkt"];
1648--2560[label="1;1pkt 1fpkt"];
1648--2658[label="1;1pkt 1fpkt"];
1648--2947[label="1;1pkt 1fpkt"];
1648--2987[label="1;2pkt 2fpkt"];
1648--3067[label="1;1pkt 1fpkt"];
1648--3370[label="1;1pkt 1fpkt"];
1648--3414[label="1;1pkt 1fpkt"];
1648--3581[label="1;1pkt 1fpkt"];
1648--3679[label="0.25;1pkt 1fpkt"];
1648--4021[label="0.00543478;1pkt 1fpkt"];
1648--4297[label="1;1pkt 1fpkt"];
1648--4442[label="1;1pkt 1fpkt"];
1648--4981[label="1;1pkt 1fpkt"];
1648--5008[label="1;1pkt 1fpkt"];
1648--5288[label="1;1pkt 1fpkt"];
1966--3679[label="0.5;1pkt 1fpkt"];
2553--3370[label="1;1pkt 1fpkt"];
2553--4442[label="1;1pkt 1fpkt"];
2553--5008[label="1;1pkt 1fpkt"];
2560--4981[label="1;1pkt 1fpkt"];
2560--5288[label="1;1pkt 1fpkt"];
3370--4442[label="1;1pkt 1fpkt"];
3370--5008[label="1;1pkt 1fpkt"];
4442--5008[label="1;1pkt 1fpkt"];
4981--5288[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="168.125.47.240" src_port="4662"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757634,1.96858,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_636{
style=filled;
color=gray75;
2687[label="23.249.29.118;d;1pkt 1fpkt", shape=diamond, color=yellow];
2688[label="202.145.196.43;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat636[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.145.196.43:2812, 23.249.29.118:6699}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (50%)&lt;BR/&gt; 2812: (50%)&gt;];
}
2687--2688[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="23.249.29.118" dst_port="6699" src_ip="202.145.196.43" src_port="2812"/>
    </slice>
    <from sec="1041397202" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.30601,1.97302,503,0 0 0 1 1 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_637{
style=filled;
color=gray75;
2474[label="172.142.193.83;d;94pkt 94fpkt", shape=diamond, color=yellow];
2691[label="90.14.20.156;s;49pkt 49fpkt", shape=diamond, color=yellow];
3090[label="172.142.193.83;d;69pkt 69fpkt", shape=hexagon, color=black];
4243[label="210.88.30.210;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4908[label="210.88.30.210;2pkt 2fpkt", shape=invtriangle, color=brown];
5240[label="210.88.30.210;1pkt 1fpkt", shape=invhouse, color=bisque];
stat637[shape=component, label=&lt;Rules:&lt;BR/&gt;{90.14.20.156:*, 172.142.193.83:80}[48.9583%]&lt;BR/&gt;{88.233.88.153:*, 172.142.193.83:80}[31.25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.537%)&lt;BR/&gt; 1360: (1.15741%)&lt;BR/&gt; 4997: (0.694444%)&lt;BR/&gt; 4533: (0.694444%)&lt;BR/&gt; 4374: (0.694444%)&gt;];
}
2474--2691[label="0.959184;47pkt 47fpkt"];
2474--3090[label="1;69pkt 69fpkt"];
2474--3275[label="0.0212766;2pkt 2fpkt"];
2474--3279[label="0.180851;17pkt 17fpkt"];
2474--3283[label="0.0638298;6pkt 6fpkt"];
2474--3284[label="0.0106383;1pkt 1fpkt"];
2474--3289[label="0.0212766;2pkt 2fpkt"];
2474--3294[label="0.180851;17pkt 17fpkt"];
2474--3298[label="0.0212766;2pkt 2fpkt"];
2474--3695[label="0.0454545;2pkt 2fpkt"];
2474--4243[label="1;1pkt 1fpkt"];
2474--4908[label="1;2pkt 2fpkt"];
2474--5240[label="1;1pkt 1fpkt"];
2691--3090[label="0.77551;38pkt 38fpkt"];
2691--3275[label="0.0408163;2pkt 2fpkt"];
2691--3278[label="0.0204082;1pkt 1fpkt"];
2691--3279[label="0.0204082;1pkt 1fpkt"];
2691--3282[label="0.0204082;1pkt 1fpkt"];
2691--3283[label="0.0612245;3pkt 3fpkt"];
2691--3284[label="0.0204082;1pkt 1fpkt"];
2691--3287[label="0.0204082;1pkt 1fpkt"];
2691--3289[label="0.0408163;2pkt 2fpkt"];
2691--3293[label="0.0204082;1pkt 1fpkt"];
2691--3294[label="0.0204082;1pkt 1fpkt"];
2691--3296[label="0.0204082;1pkt 1fpkt"];
2691--3298[label="0.0408163;2pkt 2fpkt"];
3090--3275[label="0.0289855;2pkt 2fpkt"];
3090--3279[label="0.130435;9pkt 9fpkt"];
3090--3289[label="0.0289855;2pkt 2fpkt"];
3090--3294[label="0.130435;9pkt 9fpkt"];
3090--3298[label="0.0289855;2pkt 2fpkt"];
3090--3695[label="0.0227273;1pkt 1fpkt"];
3090--4243[label="1;1pkt 1fpkt"];
3090--4908[label="1;2pkt 2fpkt"];
3090--5240[label="1;1pkt 1fpkt"];
4243--4908[label="1;1pkt 1fpkt"];
4243--5240[label="1;1pkt 1fpkt"];
4908--5240[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="172.142.193.83" dst_port="80" src_ip="90.14.20.156"/>
      <filter dst_ip="172.142.193.83" dst_port="80" src_ip="88.233.88.153"/>
    </slice>
    <from sec="1041397206" usec="0"/>
    <to sec="1041398741" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.17951,1.89871,999,1 1 1 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_638{
style=filled;
color=gray75;
38[label="148.155.246.98s;1pkt 1fpkt", shape=rectangle, color=red];
727[label="148.155.246.98s;1pkt 1fpkt", shape=ellipse, color=green];
1256[label="148.155.246.98s;1pkt 1fpkt", shape=triangle, color=blue];
1625[label="219.243.142.31;d;1pkt 1fpkt", shape=diamond, color=yellow];
1626[label="148.155.246.98;s;5pkt 5fpkt", shape=diamond, color=yellow];
1931[label="90.181.160.127;d;1pkt 1fpkt", shape=diamond, color=yellow];
2010[label="23.230.120.187;d;3pkt 3fpkt", shape=diamond, color=yellow];
2725[label="219.243.142.31;d;1pkt 1fpkt", shape=hexagon, color=black];
2838[label="148.155.246.98;s;5pkt 5fpkt", shape=hexagon, color=black];
2932[label="90.181.160.127;d;1pkt 1fpkt", shape=hexagon, color=black];
stat638[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.155.246.98:6699, *:*}[57.1429%]&lt;BR/&gt;{*:6257, 23.230.120.187:6257}[28.5714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (45%)&lt;BR/&gt; 4222: (17.5%)&lt;BR/&gt; 50226: (10%)&lt;BR/&gt; 6257: (10%)&lt;BR/&gt; 4332: (7.5%)&gt;];
}
38--727[label="1;1pkt 1fpkt"];
38--1256[label="1;1pkt 1fpkt"];
38--1625[label="1;1pkt 1fpkt"];
38--1626[label="1;1pkt 1fpkt"];
38--2725[label="1;1pkt 1fpkt"];
38--2838[label="1;1pkt 1fpkt"];
727--1256[label="1;1pkt 1fpkt"];
727--1625[label="1;1pkt 1fpkt"];
727--1626[label="1;1pkt 1fpkt"];
727--2725[label="1;1pkt 1fpkt"];
727--2838[label="1;1pkt 1fpkt"];
1256--1625[label="1;1pkt 1fpkt"];
1256--1626[label="1;1pkt 1fpkt"];
1256--2725[label="1;1pkt 1fpkt"];
1256--2838[label="1;1pkt 1fpkt"];
1625--1626[label="1;1pkt 1fpkt"];
1625--2725[label="1;1pkt 1fpkt"];
1625--2838[label="1;1pkt 1fpkt"];
1626--1931[label="1;1pkt 1fpkt"];
1626--2010[label="0.333333;1pkt 1fpkt"];
1626--2725[label="1;1pkt 1fpkt"];
1626--2838[label="1;5pkt 5fpkt"];
1626--2932[label="1;1pkt 1fpkt"];
1931--2838[label="1;1pkt 1fpkt"];
1931--2932[label="1;1pkt 1fpkt"];
2010--2838[label="0.333333;1pkt 1fpkt"];
2010--3281[label="0.333333;1pkt 1fpkt"];
2010--3286[label="0.333333;1pkt 1fpkt"];
2725--2838[label="1;1pkt 1fpkt"];
2838--2932[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="148.155.246.98" src_port="6699"/>
      <filter dst_ip="23.230.120.187" dst_port="6257" src_port="6257"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_640{
style=filled;
color=gray75;
1684[label="219.42.2.97;d;3pkt 3fpkt", shape=diamond, color=yellow];
1685[label="144.52.3.17;s;3pkt 3fpkt", shape=diamond, color=yellow];
2739[label="144.52.3.17;s;1pkt 1fpkt", shape=hexagon, color=black];
stat640[shape=component, label=&lt;Rules:&lt;BR/&gt;{144.52.3.17:2316, 219.42.2.97:64671}[33.3333%]&lt;BR/&gt;{144.52.3.17:2343, 219.42.2.97:62410}[33.3333%]&lt;BR/&gt;{144.52.3.17:4865, 219.42.2.97:64398}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 64671: (21.4286%)&lt;BR/&gt; 2316: (21.4286%)&lt;BR/&gt; 64398: (14.2857%)&lt;BR/&gt; 62410: (14.2857%)&lt;BR/&gt; 4865: (14.2857%)&gt;];
}
1684--1685[label="1;3pkt 3fpkt"];
1684--2739[label="1;1pkt 1fpkt"];
1685--2739[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="219.42.2.97" dst_port="64398" src_ip="144.52.3.17" src_port="4865"/>
      <filter dst_ip="219.42.2.97" dst_port="62410" src_ip="144.52.3.17" src_port="2343"/>
      <filter dst_ip="219.42.2.97" dst_port="64671" src_ip="144.52.3.17" src_port="2316"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.04205,1.95237,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_642{
style=filled;
color=gray75;
1723[label="144.52.65.241;d;1pkt 1fpkt", shape=diamond, color=yellow];
1724[label="88.46.251.38;s;2pkt 2fpkt", shape=diamond, color=yellow];
2677[label="148.155.42.1;d;1pkt 1fpkt", shape=diamond, color=yellow];
2763[label="88.46.251.38;s;1pkt 1fpkt", shape=hexagon, color=black];
3515[label="88.46.251.38;2pkt 2fpkt", shape=pentagon, color=darkviolet];
stat642[shape=component, label=&lt;Rules:&lt;BR/&gt;{88.46.251.38:80, 148.155.42.1:4509}[50%]&lt;BR/&gt;{88.46.251.38:80, 144.52.65.241:49159}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 49159: (28.5714%)&lt;BR/&gt; 4509: (21.4286%)&gt;];
}
1723--1724[label="1;1pkt 1fpkt"];
1723--2763[label="1;1pkt 1fpkt"];
1723--3515[label="1;1pkt 1fpkt"];
1724--2677[label="1;1pkt 1fpkt"];
1724--2763[label="1;1pkt 1fpkt"];
1724--3515[label="1;2pkt 2fpkt"];
2677--3515[label="1;1pkt 1fpkt"];
2763--3515[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="144.52.65.241" dst_port="49159" src_ip="88.46.251.38" src_port="80"/>
      <filter dst_ip="148.155.42.1" dst_port="4509" src_ip="88.46.251.38" src_port="80"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_643{
style=filled;
color=gray75;
1837[label="70.218.130.133;d;1pkt 1fpkt", shape=diamond, color=yellow];
2765[label="70.218.130.133;d;1pkt 1fpkt", shape=hexagon, color=black];
stat643[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.196.63:6699, 70.218.130.133:1155}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (50%)&lt;BR/&gt; 1155: (50%)&gt;];
}
1837--2765[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="70.218.130.133" dst_port="1155" src_ip="136.234.196.63" src_port="6699"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398658" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_644{
style=filled;
color=gray75;
1840[label="25.229.23.148;d;1pkt 1fpkt", shape=diamond, color=yellow];
2780[label="25.229.23.148;d;1pkt 1fpkt", shape=hexagon, color=black];
stat644[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.187.105:3561, 25.229.23.148:6699}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (50%)&lt;BR/&gt; 3561: (50%)&gt;];
}
1840--2780[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="25.229.23.148" dst_port="6699" src_ip="136.234.187.105" src_port="3561"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398350" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_645{
style=filled;
color=gray75;
1849[label="70.135.55.32;d;2pkt 2fpkt", shape=diamond, color=yellow];
2784[label="70.135.55.32;d;2pkt 2fpkt", shape=hexagon, color=black];
stat645[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.187.105:4662, 70.135.55.32:1206}[50%]&lt;BR/&gt;{136.234.187.105:4662, 70.135.55.32:4112}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4662: (50%)&lt;BR/&gt; 4112: (25%)&lt;BR/&gt; 1206: (25%)&gt;];
}
1849--2784[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="70.135.55.32" dst_port="4112" src_ip="136.234.187.105" src_port="4662"/>
      <filter dst_ip="70.135.55.32" dst_port="1206" src_ip="136.234.187.105" src_port="4662"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398147" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_647{
style=filled;
color=gray75;
1691[label="61.209.33.165;s;131pkt 131fpkt", shape=diamond, color=yellow];
2756[label="61.209.33.165;s;124pkt 124fpkt", shape=hexagon, color=black];
2803[label="136.234.170.208;d;145pkt 145fpkt", shape=hexagon, color=black];
stat647[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.209.33.165:80, 136.234.170.208:*}[90.3448%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1552: (0.375%)&lt;BR/&gt; 1551: (0.375%)&lt;BR/&gt; 1550: (0.375%)&lt;BR/&gt; 1549: (0.375%)&gt;];
}
1691--2756[label="1;124pkt 124fpkt"];
1691--2803[label="1;131pkt 131fpkt"];
2756--2803[label="1;124pkt 124fpkt"];
2803--3339[label="0.3;3pkt 3fpkt"];
2803--3378[label="0.0526316;1pkt 1fpkt"];
2803--3896[label="0.0344828;1pkt 1fpkt"];
2803--4423[label="0.363636;4pkt 4fpkt"];
2803--4446[label="0.0555556;1pkt 1fpkt"];
2803--4717[label="0.0344828;1pkt 1fpkt"];
2803--5010[label="0.0555556;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="136.234.170.208" src_ip="61.209.33.165" src_port="80"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041397567" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_648{
style=filled;
color=gray75;
1975[label="136.234.119.128;s;3pkt 3fpkt", shape=diamond, color=yellow];
2144[label="93.147.107.166;d;1pkt 1fpkt", shape=diamond, color=yellow];
2253[label="193.117.47.59;d;2pkt 2fpkt", shape=diamond, color=yellow];
2805[label="136.234.119.128;s;3pkt 3fpkt", shape=hexagon, color=black];
2966[label="193.117.47.59;d;2pkt 2fpkt", shape=hexagon, color=black];
stat648[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.118.106:6257, 193.117.47.59:6257}[25%]&lt;BR/&gt;{136.234.119.128:2616, 62.137.147.124:6699}[25%]&lt;BR/&gt;{136.234.119.128:6699, 93.147.107.166:64692}[25%]&lt;BR/&gt;{136.234.119.128:2614, 193.117.47.59:6699}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (40.9091%)&lt;BR/&gt; 6257: (18.1818%)&lt;BR/&gt; 2614: (18.1818%)&lt;BR/&gt; 64692: (13.6364%)&lt;BR/&gt; 2616: (9.09091%)&gt;];
}
1975--2144[label="1;1pkt 1fpkt"];
1975--2253[label="0.5;1pkt 1fpkt"];
1975--2805[label="1;3pkt 3fpkt"];
1975--2966[label="0.5;1pkt 1fpkt"];
2144--2805[label="1;1pkt 1fpkt"];
2253--2805[label="0.5;1pkt 1fpkt"];
2253--2966[label="1;2pkt 2fpkt"];
2253--3281[label="0.5;1pkt 1fpkt"];
2253--3286[label="0.5;1pkt 1fpkt"];
2805--2966[label="0.5;1pkt 1fpkt"];
2966--3281[label="0.5;1pkt 1fpkt"];
2966--3286[label="0.5;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="193.117.47.59" dst_port="6699" src_ip="136.234.119.128" src_port="2614"/>
      <filter dst_ip="93.147.107.166" dst_port="64692" src_ip="136.234.119.128" src_port="6699"/>
      <filter dst_ip="62.137.147.124" dst_port="6699" src_ip="136.234.119.128" src_port="2616"/>
      <filter dst_ip="193.117.47.59" dst_port="6257" src_ip="136.234.118.106" src_port="6257"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_649{
style=filled;
color=gray75;
1844[label="61.81.32.210;d;1pkt 1fpkt", shape=diamond, color=yellow];
2814[label="61.81.32.210;d;1pkt 1fpkt", shape=hexagon, color=black];
stat649[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.9.38.12:58329, 61.81.32.210:2000}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 58329: (50%)&lt;BR/&gt; 2000: (50%)&gt;];
}
1844--2814[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="61.81.32.210" dst_port="2000" src_ip="202.9.38.12" src_port="58329"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398658" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_650{
style=filled;
color=gray75;
2006[label="202.42.24.227;s;281pkt 281fpkt", shape=diamond, color=yellow];
2819[label="202.42.24.227;s;266pkt 266fpkt", shape=hexagon, color=black];
stat650[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.42.24.227:25, *:*}[98.2206%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (49.0859%)&lt;BR/&gt; 0: (1.82815%)&lt;BR/&gt; 40432: (0.365631%)&lt;BR/&gt; 64116: (0.182815%)&lt;BR/&gt; 60932: (0.182815%)&gt;];
}
2006--2819[label="1;266pkt 266fpkt"];
</description>
    <slice>
      <filter src_ip="202.42.24.227" src_port="25"/>
    </slice>
    <from sec="1041397202" usec="0"/>
    <to sec="1041398742" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_651{
style=filled;
color=gray75;
1752[label="204.79.38.242;d;27pkt 27fpkt", shape=diamond, color=yellow];
2821[label="204.79.38.242;d;26pkt 26fpkt", shape=hexagon, color=black];
stat651[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.59.18.72:*, 204.79.38.242:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (7.54717%)&lt;BR/&gt; 54900: (1.88679%)&lt;BR/&gt; 54898: (1.88679%)&lt;BR/&gt; 54897: (1.88679%)&lt;BR/&gt; 54896: (1.88679%)&gt;];
}
1752--2821[label="1;26pkt 26fpkt"];
</description>
    <slice>
      <filter dst_ip="204.79.38.242" src_ip="203.59.18.72"/>
    </slice>
    <from sec="1041397203" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_652{
style=filled;
color=gray75;
2015[label="203.59.19.7;s;82pkt 82fpkt", shape=diamond, color=yellow];
2826[label="203.59.19.7;s;60pkt 60fpkt", shape=hexagon, color=black];
stat652[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.59.19.7:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
2015--2826[label="1;60pkt 60fpkt"];
</description>
    <slice>
      <filter src_ip="203.59.19.7"/>
    </slice>
    <from sec="1041397213" usec="0"/>
    <to sec="1041398726" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_653{
style=filled;
color=gray75;
1879[label="218.208.225.16;d;76pkt 76fpkt", shape=diamond, color=yellow];
2828[label="218.208.225.16;d;76pkt 76fpkt", shape=hexagon, color=black];
stat653[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.78.215:*, 218.208.225.16:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2816: (0.657895%)&lt;BR/&gt; 2706: (0.657895%)&lt;BR/&gt; 2704: (0.657895%)&lt;BR/&gt; 2703: (0.657895%)&gt;];
}
1879--2828[label="1;76pkt 76fpkt"];
1879--3275[label="0.0131579;1pkt 1fpkt"];
1879--3289[label="0.0131579;1pkt 1fpkt"];
1879--3298[label="0.0131579;1pkt 1fpkt"];
2828--3275[label="0.0131579;1pkt 1fpkt"];
2828--3289[label="0.0131579;1pkt 1fpkt"];
2828--3298[label="0.0131579;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="218.208.225.16" dst_port="80" src_ip="136.234.78.215"/>
    </slice>
    <from sec="1041397228" usec="0"/>
    <to sec="1041397483" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.12182,1.93656,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_654{
style=filled;
color=gray75;
1960[label="148.155.58.155;s;62pkt 62fpkt", shape=diamond, color=yellow];
2023[label="218.27.138.133;d;5pkt 5fpkt", shape=diamond, color=yellow];
2832[label="218.27.138.133;d;4pkt 4fpkt", shape=hexagon, color=black];
2833[label="148.155.58.155;s;30pkt 30fpkt", shape=hexagon, color=black];
4035[label="148.155.58.155;62pkt 62fpkt", shape=pentagon, color=darkviolet];
4795[label="148.155.58.155;61pkt 61fpkt", shape=invtriangle, color=brown];
stat654[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.155.58.155:*, 218.149.90.253:80}[32.2581%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1194: (1.33929%)&lt;BR/&gt; 1173: (1.33929%)&lt;BR/&gt; 1112: (1.33929%)&lt;BR/&gt; 1111: (1.33929%)&gt;];
}
1960--2023[label="1;5pkt 5fpkt"];
1960--2832[label="1;4pkt 4fpkt"];
1960--2833[label="1;30pkt 30fpkt"];
1960--4035[label="1;62pkt 62fpkt"];
1960--4795[label="1;61pkt 61fpkt"];
2023--2832[label="1;4pkt 4fpkt"];
2023--2833[label="0.8;4pkt 4fpkt"];
2023--4035[label="1;5pkt 5fpkt"];
2023--4795[label="1;5pkt 5fpkt"];
2832--2833[label="1;4pkt 4fpkt"];
2832--4035[label="1;4pkt 4fpkt"];
2832--4795[label="1;4pkt 4fpkt"];
2833--4035[label="1;30pkt 30fpkt"];
2833--4795[label="0.966667;29pkt 29fpkt"];
4035--4795[label="1;61pkt 61fpkt"];
</description>
    <slice>
      <filter dst_ip="218.149.90.253" dst_port="80" src_ip="148.155.58.155"/>
    </slice>
    <from sec="1041397349" usec="0"/>
    <to sec="1041397692" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_655{
style=filled;
color=gray75;
2085[label="168.125.225.236;s;15pkt 15fpkt", shape=diamond, color=yellow];
2856[label="168.125.225.236;s;95pkt 95fpkt", shape=hexagon, color=black];
stat655[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.125.225.236:*, 209.40.217.185:80}[34.8624%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.7273%)&lt;BR/&gt; 1863: (0.909091%)&lt;BR/&gt; 1214: (0.909091%)&lt;BR/&gt; 1071: (0.909091%)&lt;BR/&gt; 2699: (0.454545%)&gt;];
}
2085--2856[label="0.0666667;1pkt 1fpkt"];
2085--3284[label="0.333333;5pkt 5fpkt"];
2856--3087[label="0.4;38pkt 38fpkt"];
2856--3275[label="0.189474;18pkt 18fpkt"];
2856--3289[label="0.189474;18pkt 18fpkt"];
2856--3298[label="0.189474;18pkt 18fpkt"];
</description>
    <slice>
      <filter dst_ip="209.40.217.185" dst_port="80" src_ip="168.125.225.236"/>
    </slice>
    <from sec="1041397202" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.04205,1.95237,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_656{
style=filled;
color=gray75;
1988[label="144.52.151.108;d;295pkt 295fpkt", shape=diamond, color=yellow];
2105[label="206.46.52.134;s;268pkt 268fpkt", shape=diamond, color=yellow];
2858[label="206.46.52.134;s;143pkt 143fpkt", shape=hexagon, color=black];
3588[label="90.128.205.56;16pkt 16fpkt", shape=pentagon, color=darkviolet];
stat656[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.46.52.134:2064, 144.52.151.108:*}[86.4516%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2064: (48.8227%)&lt;BR/&gt; 443: (1.17729%)&lt;BR/&gt; 32397: (0.207756%)&lt;BR/&gt; 32001: (0.207756%)&lt;BR/&gt; 30394: (0.207756%)&gt;];
}
1988--2105[label="1;268pkt 268fpkt"];
1988--2858[label="1;143pkt 143fpkt"];
1988--3588[label="0.0625;1pkt 1fpkt"];
2105--2858[label="1;143pkt 143fpkt"];
</description>
    <slice>
      <filter dst_ip="144.52.151.108" src_ip="206.46.52.134" src_port="2064"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398780" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_657{
style=filled;
color=gray75;
2028[label="136.234.167.73;d;8pkt 8fpkt", shape=diamond, color=yellow];
2030[label="209.97.144.41;s;2pkt 2fpkt", shape=diamond, color=yellow];
2862[label="136.234.167.73;d;8pkt 8fpkt", shape=hexagon, color=black];
2863[label="209.97.144.41;s;2pkt 2fpkt", shape=hexagon, color=black];
stat657[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.97.144.41:*, 136.234.167.73:5555}[25%]&lt;BR/&gt;{209.97.144.41:7743, 136.234.167.73:*}[25%]&lt;BR/&gt;{93.59.68.178:*, 136.234.167.73:5555}[25%]&lt;BR/&gt;{93.59.68.178:7773, 136.234.167.73:*}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5555: (25%)&lt;BR/&gt; 7743: (15%)&lt;BR/&gt; 7773: (10%)&lt;BR/&gt; 4654: (10%)&lt;BR/&gt; 2637: (10%)&gt;];
}
2028--2030[label="1;2pkt 2fpkt"];
2028--2862[label="1;8pkt 8fpkt"];
2028--2863[label="1;2pkt 2fpkt"];
2030--2862[label="1;2pkt 2fpkt"];
2030--2863[label="1;2pkt 2fpkt"];
2862--2863[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="136.234.167.73" src_ip="93.59.68.178" src_port="7773"/>
      <filter dst_ip="136.234.167.73" dst_port="5555" src_ip="93.59.68.178"/>
      <filter dst_ip="136.234.167.73" src_ip="209.97.144.41" src_port="7743"/>
      <filter dst_ip="136.234.167.73" dst_port="5555" src_ip="209.97.144.41"/>
    </slice>
    <from sec="1041397446" usec="0"/>
    <to sec="1041397772" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.04343,1.95109,999,1 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_658{
style=filled;
color=gray75;
650[label="61.163.8.103d;1pkt 1fpkt", shape=rectangle, color=red];
654[label="4.134.190.126d;1pkt 1fpkt", shape=rectangle, color=red];
665[label="193.115.141.244d;1pkt 1fpkt", shape=rectangle, color=red];
1617[label="61.19.64.249;d;10pkt 10fpkt", shape=diamond, color=yellow];
1774[label="136.234.119.19;s;4901pkt 4901fpkt", shape=diamond, color=yellow];
1799[label="61.81.148.139;d;1pkt 1fpkt", shape=diamond, color=yellow];
1888[label="23.237.65.158;d;1pkt 1fpkt", shape=diamond, color=yellow];
1890[label="23.207.154.30;d;1pkt 1fpkt", shape=diamond, color=yellow];
1900[label="23.195.203.116;d;1pkt 1fpkt", shape=diamond, color=yellow];
1903[label="23.206.99.193;d;1pkt 1fpkt", shape=diamond, color=yellow];
1911[label="174.236.60.8;d;1pkt 1fpkt", shape=diamond, color=yellow];
1921[label="4.24.179.24;d;1pkt 1fpkt", shape=diamond, color=yellow];
1925[label="61.7.74.117;d;1pkt 1fpkt", shape=diamond, color=yellow];
1928[label="90.27.221.133;d;1pkt 1fpkt", shape=diamond, color=yellow];
1930[label="140.144.168.121;d;1pkt 1fpkt", shape=diamond, color=yellow];
1932[label="4.110.97.162;d;1pkt 1fpkt", shape=diamond, color=yellow];
1933[label="210.224.133.195;d;1pkt 1fpkt", shape=diamond, color=yellow];
1937[label="211.162.172.77;d;1pkt 1fpkt", shape=diamond, color=yellow];
1939[label="23.248.178.142;d;1pkt 1fpkt", shape=diamond, color=yellow];
1940[label="23.243.83.210;d;2pkt 2fpkt", shape=diamond, color=yellow];
1944[label="23.251.87.56;d;1pkt 1fpkt", shape=diamond, color=yellow];
1945[label="90.109.184.169;d;1pkt 1fpkt", shape=diamond, color=yellow];
1968[label="23.204.120.189;d;1pkt 1fpkt", shape=diamond, color=yellow];
1976[label="203.184.97.83;d;2pkt 2fpkt", shape=diamond, color=yellow];
1977[label="208.42.6.6;d;1pkt 1fpkt", shape=diamond, color=yellow];
1981[label="4.146.5.115;d;1pkt 1fpkt", shape=diamond, color=yellow];
2002[label="23.239.93.178;d;1pkt 1fpkt", shape=diamond, color=yellow];
2052[label="210.224.23.253;d;1pkt 1fpkt", shape=diamond, color=yellow];
2076[label="211.116.192.244;d;1pkt 1fpkt", shape=diamond, color=yellow];
2077[label="4.91.181.136;d;1pkt 1fpkt", shape=diamond, color=yellow];
2078[label="89.116.9.229;d;2pkt 2fpkt", shape=diamond, color=yellow];
2079[label="140.144.21.244;d;1pkt 1fpkt", shape=diamond, color=yellow];
2111[label="89.193.149.194;d;1pkt 1fpkt", shape=diamond, color=yellow];
2114[label="23.225.181.138;d;1pkt 1fpkt", shape=diamond, color=yellow];
2141[label="211.55.104.218;d;2pkt 2fpkt", shape=diamond, color=yellow];
2239[label="23.201.54.16;d;1pkt 1fpkt", shape=diamond, color=yellow];
2278[label="154.179.155.233;d;1pkt 1fpkt", shape=diamond, color=yellow];
2289[label="216.63.222.143;d;1pkt 1fpkt", shape=diamond, color=yellow];
2294[label="23.237.130.126;d;1pkt 1fpkt", shape=diamond, color=yellow];
2295[label="140.152.5.90;d;1pkt 1fpkt", shape=diamond, color=yellow];
2296[label="61.25.199.74;d;1pkt 1fpkt", shape=diamond, color=yellow];
2331[label="210.226.30.177;d;1pkt 1fpkt", shape=diamond, color=yellow];
2352[label="4.33.209.173;d;1pkt 1fpkt", shape=diamond, color=yellow];
2391[label="4.143.4.149;d;1pkt 1fpkt", shape=diamond, color=yellow];
2395[label="210.224.86.119;d;1pkt 1fpkt", shape=diamond, color=yellow];
2502[label="140.152.5.147;d;1pkt 1fpkt", shape=diamond, color=yellow];
2542[label="211.48.3.126;d;1pkt 1fpkt", shape=diamond, color=yellow];
2547[label="23.237.228.103;d;1pkt 1fpkt", shape=diamond, color=yellow];
2663[label="23.249.244.117;d;1pkt 1fpkt", shape=diamond, color=yellow];
2781[label="61.7.74.117;d;1pkt 1fpkt", shape=hexagon, color=black];
2783[label="210.224.133.195;d;1pkt 1fpkt", shape=hexagon, color=black];
2798[label="23.207.154.30;d;1pkt 1fpkt", shape=hexagon, color=black];
2818[label="90.109.184.169;d;1pkt 1fpkt", shape=hexagon, color=black];
2847[label="4.24.179.24;d;1pkt 1fpkt", shape=hexagon, color=black];
2853[label="23.251.87.56;d;1pkt 1fpkt", shape=hexagon, color=black];
2865[label="136.234.119.19;s;4275pkt 4275fpkt", shape=hexagon, color=black];
2881[label="210.224.23.253;d;1pkt 1fpkt", shape=hexagon, color=black];
2891[label="211.116.192.244;d;1pkt 1fpkt", shape=hexagon, color=black];
2907[label="23.225.181.138;d;1pkt 1fpkt", shape=hexagon, color=black];
2915[label="23.195.203.116;d;1pkt 1fpkt", shape=hexagon, color=black];
2918[label="23.206.99.193;d;1pkt 1fpkt", shape=hexagon, color=black];
2921[label="174.236.60.8;d;1pkt 1fpkt", shape=hexagon, color=black];
2935[label="23.239.93.178;d;1pkt 1fpkt", shape=hexagon, color=black];
2944[label="23.204.120.189;d;1pkt 1fpkt", shape=hexagon, color=black];
2971[label="90.27.221.133;d;1pkt 1fpkt", shape=hexagon, color=black];
2972[label="211.162.172.77;d;1pkt 1fpkt", shape=hexagon, color=black];
2986[label="23.237.130.126;d;1pkt 1fpkt", shape=hexagon, color=black];
3014[label="203.184.97.83;d;2pkt 2fpkt", shape=hexagon, color=black];
3021[label="23.243.83.210;d;2pkt 2fpkt", shape=hexagon, color=black];
3062[label="4.143.4.149;d;1pkt 1fpkt", shape=hexagon, color=black];
3069[label="23.237.65.158;d;1pkt 1fpkt", shape=hexagon, color=black];
3079[label="4.110.97.162;d;1pkt 1fpkt", shape=hexagon, color=black];
3112[label="61.81.148.139;d;1pkt 1fpkt", shape=hexagon, color=black];
3155[label="210.226.30.177;d;1pkt 1fpkt", shape=hexagon, color=black];
3164[label="216.63.222.143;d;1pkt 1fpkt", shape=hexagon, color=black];
3167[label="140.152.5.90;d;1pkt 1fpkt", shape=hexagon, color=black];
stat658[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.119.19:1412, *:*}[99.6736%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1412: (49.7949%)&lt;BR/&gt; 1214: (3.53481%)&lt;BR/&gt; 2640: (0.172693%)&lt;BR/&gt; 3241: (0.0917431%)&lt;BR/&gt; 3878: (0.0809498%)&gt;];
}
650--1774[label="1;1pkt 1fpkt"];
650--2547[label="1;1pkt 1fpkt"];
650--2865[label="1;1pkt 1fpkt"];
654--1774[label="1;1pkt 1fpkt"];
654--2294[label="1;1pkt 1fpkt"];
654--2865[label="1;1pkt 1fpkt"];
654--2986[label="1;1pkt 1fpkt"];
665--1774[label="1;1pkt 1fpkt"];
665--2079[label="1;1pkt 1fpkt"];
665--2865[label="1;1pkt 1fpkt"];
1617--1774[label="1;10pkt 10fpkt"];
1617--2865[label="0.8;8pkt 8fpkt"];
1774--1799[label="1;1pkt 1fpkt"];
1774--1888[label="1;1pkt 1fpkt"];
1774--1890[label="1;1pkt 1fpkt"];
1774--1900[label="1;1pkt 1fpkt"];
1774--1903[label="1;1pkt 1fpkt"];
1774--1911[label="1;1pkt 1fpkt"];
1774--1921[label="1;1pkt 1fpkt"];
1774--1925[label="1;1pkt 1fpkt"];
1774--1928[label="1;1pkt 1fpkt"];
1774--1930[label="1;1pkt 1fpkt"];
1774--1932[label="1;1pkt 1fpkt"];
1774--1933[label="1;1pkt 1fpkt"];
1774--1937[label="1;1pkt 1fpkt"];
1774--1939[label="1;1pkt 1fpkt"];
1774--1940[label="1;2pkt 2fpkt"];
1774--1944[label="1;1pkt 1fpkt"];
1774--1945[label="1;1pkt 1fpkt"];
1774--1968[label="1;1pkt 1fpkt"];
1774--1976[label="0.5;1pkt 1fpkt"];
1774--1977[label="1;1pkt 1fpkt"];
1774--1981[label="1;1pkt 1fpkt"];
1774--2002[label="1;1pkt 1fpkt"];
1774--2052[label="1;1pkt 1fpkt"];
1774--2076[label="1;1pkt 1fpkt"];
1774--2077[label="1;1pkt 1fpkt"];
1774--2078[label="1;2pkt 2fpkt"];
1774--2079[label="1;1pkt 1fpkt"];
1774--2111[label="1;1pkt 1fpkt"];
1774--2114[label="1;1pkt 1fpkt"];
1774--2141[label="1;2pkt 2fpkt"];
1774--2223[label="1;1pkt 1fpkt"];
1774--2239[label="1;1pkt 1fpkt"];
1774--2278[label="1;1pkt 1fpkt"];
1774--2289[label="1;1pkt 1fpkt"];
1774--2294[label="1;1pkt 1fpkt"];
1774--2295[label="1;1pkt 1fpkt"];
1774--2296[label="1;1pkt 1fpkt"];
1774--2331[label="1;1pkt 1fpkt"];
1774--2352[label="1;1pkt 1fpkt"];
1774--2391[label="1;1pkt 1fpkt"];
1774--2395[label="1;1pkt 1fpkt"];
1774--2502[label="1;1pkt 1fpkt"];
1774--2542[label="1;1pkt 1fpkt"];
1774--2547[label="1;1pkt 1fpkt"];
1774--2604[label="1;1pkt 1fpkt"];
1774--2663[label="1;1pkt 1fpkt"];
1774--2666[label="1;1pkt 1fpkt"];
1774--2757[label="1;1pkt 1fpkt"];
1774--2781[label="1;1pkt 1fpkt"];
1774--2783[label="1;1pkt 1fpkt"];
1774--2798[label="1;1pkt 1fpkt"];
1774--2818[label="1;1pkt 1fpkt"];
1774--2847[label="1;1pkt 1fpkt"];
1774--2853[label="1;1pkt 1fpkt"];
1774--2865[label="1;4275pkt 4275fpkt"];
1774--2881[label="1;1pkt 1fpkt"];
1774--2891[label="1;1pkt 1fpkt"];
1774--2907[label="1;1pkt 1fpkt"];
1774--2915[label="1;1pkt 1fpkt"];
1774--2918[label="1;1pkt 1fpkt"];
1774--2921[label="1;1pkt 1fpkt"];
1774--2935[label="1;1pkt 1fpkt"];
1774--2944[label="1;1pkt 1fpkt"];
1774--2953[label="1;1pkt 1fpkt"];
1774--2971[label="1;1pkt 1fpkt"];
1774--2972[label="1;1pkt 1fpkt"];
1774--2986[label="1;1pkt 1fpkt"];
1774--3014[label="0.5;1pkt 1fpkt"];
1774--3021[label="1;2pkt 2fpkt"];
1774--3062[label="1;1pkt 1fpkt"];
1774--3069[label="1;1pkt 1fpkt"];
1774--3079[label="1;1pkt 1fpkt"];
1774--3112[label="1;1pkt 1fpkt"];
1774--3141[label="1;1pkt 1fpkt"];
1774--3155[label="1;1pkt 1fpkt"];
1774--3164[label="1;1pkt 1fpkt"];
1774--3167[label="1;1pkt 1fpkt"];
1774--3179[label="1;1pkt 1fpkt"];
1799--2865[label="1;1pkt 1fpkt"];
1799--3112[label="1;1pkt 1fpkt"];
1888--2865[label="1;1pkt 1fpkt"];
1888--3069[label="1;1pkt 1fpkt"];
1890--2798[label="1;1pkt 1fpkt"];
1890--2865[label="1;1pkt 1fpkt"];
1900--2865[label="1;1pkt 1fpkt"];
1900--2915[label="1;1pkt 1fpkt"];
1903--2865[label="1;1pkt 1fpkt"];
1903--2918[label="1;1pkt 1fpkt"];
1911--2865[label="1;1pkt 1fpkt"];
1911--2921[label="1;1pkt 1fpkt"];
1921--2847[label="1;1pkt 1fpkt"];
1921--2865[label="1;1pkt 1fpkt"];
1925--2781[label="1;1pkt 1fpkt"];
1925--2865[label="1;1pkt 1fpkt"];
1928--2865[label="1;1pkt 1fpkt"];
1928--2971[label="1;1pkt 1fpkt"];
1930--2865[label="1;1pkt 1fpkt"];
1932--2865[label="1;1pkt 1fpkt"];
1932--3079[label="1;1pkt 1fpkt"];
1933--2783[label="1;1pkt 1fpkt"];
1933--2865[label="1;1pkt 1fpkt"];
1937--2865[label="1;1pkt 1fpkt"];
1937--2972[label="1;1pkt 1fpkt"];
1939--2865[label="1;1pkt 1fpkt"];
1940--2865[label="1;2pkt 2fpkt"];
1940--3021[label="1;2pkt 2fpkt"];
1944--2853[label="1;1pkt 1fpkt"];
1944--2865[label="1;1pkt 1fpkt"];
1945--2818[label="1;1pkt 1fpkt"];
1945--2865[label="1;1pkt 1fpkt"];
1968--2865[label="1;1pkt 1fpkt"];
1968--2944[label="1;1pkt 1fpkt"];
1976--2865[label="0.5;1pkt 1fpkt"];
1976--3014[label="1;2pkt 2fpkt"];
1977--2865[label="1;1pkt 1fpkt"];
1981--2865[label="1;1pkt 1fpkt"];
2002--2865[label="1;1pkt 1fpkt"];
2002--2935[label="1;1pkt 1fpkt"];
2052--2865[label="1;1pkt 1fpkt"];
2052--2881[label="1;1pkt 1fpkt"];
2076--2865[label="1;1pkt 1fpkt"];
2076--2891[label="1;1pkt 1fpkt"];
2077--2865[label="1;1pkt 1fpkt"];
2078--2865[label="1;2pkt 2fpkt"];
2079--2865[label="1;1pkt 1fpkt"];
2111--2865[label="1;1pkt 1fpkt"];
2114--2865[label="1;1pkt 1fpkt"];
2114--2907[label="1;1pkt 1fpkt"];
2141--2865[label="1;2pkt 2fpkt"];
2239--2865[label="1;1pkt 1fpkt"];
2278--2865[label="1;1pkt 1fpkt"];
2289--2865[label="1;1pkt 1fpkt"];
2289--3164[label="1;1pkt 1fpkt"];
2294--2865[label="1;1pkt 1fpkt"];
2294--2986[label="1;1pkt 1fpkt"];
2295--2865[label="1;1pkt 1fpkt"];
2295--3167[label="1;1pkt 1fpkt"];
2296--2865[label="1;1pkt 1fpkt"];
2331--2865[label="1;1pkt 1fpkt"];
2331--3155[label="1;1pkt 1fpkt"];
2352--2865[label="1;1pkt 1fpkt"];
2391--2865[label="1;1pkt 1fpkt"];
2391--3062[label="1;1pkt 1fpkt"];
2395--2865[label="1;1pkt 1fpkt"];
2502--2865[label="1;1pkt 1fpkt"];
2542--2865[label="1;1pkt 1fpkt"];
2547--2865[label="1;1pkt 1fpkt"];
2781--2865[label="1;1pkt 1fpkt"];
2783--2865[label="1;1pkt 1fpkt"];
2798--2865[label="1;1pkt 1fpkt"];
2818--2865[label="1;1pkt 1fpkt"];
2847--2865[label="1;1pkt 1fpkt"];
2853--2865[label="1;1pkt 1fpkt"];
2865--2881[label="1;1pkt 1fpkt"];
2865--2891[label="1;1pkt 1fpkt"];
2865--2907[label="1;1pkt 1fpkt"];
2865--2915[label="1;1pkt 1fpkt"];
2865--2918[label="1;1pkt 1fpkt"];
2865--2921[label="1;1pkt 1fpkt"];
2865--2935[label="1;1pkt 1fpkt"];
2865--2944[label="1;1pkt 1fpkt"];
2865--2953[label="1;1pkt 1fpkt"];
2865--2971[label="1;1pkt 1fpkt"];
2865--2972[label="1;1pkt 1fpkt"];
2865--2986[label="1;1pkt 1fpkt"];
2865--3014[label="0.5;1pkt 1fpkt"];
2865--3021[label="1;2pkt 2fpkt"];
2865--3062[label="1;1pkt 1fpkt"];
2865--3069[label="1;1pkt 1fpkt"];
2865--3079[label="1;1pkt 1fpkt"];
2865--3112[label="1;1pkt 1fpkt"];
2865--3155[label="1;1pkt 1fpkt"];
2865--3164[label="1;1pkt 1fpkt"];
2865--3167[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="136.234.119.19" src_port="1412"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.04205,1.95237,010,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_659{
style=filled;
color=gray75;
1902[label="148.155.54.121;s;648pkt 648fpkt", shape=diamond, color=yellow];
2876[label="148.155.54.121;s;605pkt 605fpkt", shape=hexagon, color=black];
3867[label="148.155.54.121;678pkt 678fpkt", shape=pentagon, color=darkviolet];
stat659[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.155.54.121:*, *:25}[89.233%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (48.2651%)&lt;BR/&gt; 110: (1.42413%)&lt;BR/&gt; 0: (0.46608%)&lt;BR/&gt; 47916: (0.15536%)&lt;BR/&gt; 3056: (0.15536%)&gt;];
}
1902--2876[label="1;605pkt 605fpkt"];
1902--3867[label="1;648pkt 648fpkt"];
2876--3867[label="1;605pkt 605fpkt"];
</description>
    <slice>
      <filter dst_port="25" src_ip="148.155.54.121"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398822" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_660{
style=filled;
color=gray75;
2152[label="193.112.64.58;s;1pkt 1fpkt", shape=diamond, color=yellow];
2897[label="144.52.66.93;d;2pkt 2fpkt", shape=hexagon, color=black];
stat660[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.112.64.58:6699, 144.52.66.93:1053}[50%]&lt;BR/&gt;{219.140.128.108:6699, 144.52.66.93:1070}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (50%)&lt;BR/&gt; 1053: (33.3333%)&lt;BR/&gt; 1070: (16.6667%)&gt;];
}
2152--2897[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="144.52.66.93" dst_port="1070" src_ip="219.140.128.108" src_port="6699"/>
      <filter dst_ip="144.52.66.93" dst_port="1053" src_ip="193.112.64.58" src_port="6699"/>
    </slice>
    <from sec="1041397209" usec="0"/>
    <to sec="1041398656" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757634,1.96858,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_661{
style=filled;
color=gray75;
2166[label="207.17.209.142;s;5pkt 5fpkt", shape=diamond, color=yellow];
stat661[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.17.209.142:80, 148.155.128.230:3966}[20%]&lt;BR/&gt;{207.17.209.142:80, 148.155.128.230:3986}[20%]&lt;BR/&gt;{207.17.209.142:80, 148.155.128.230:3987}[20%]&lt;BR/&gt;{207.17.209.142:80, 148.155.128.230:3990}[20%]&lt;BR/&gt;{207.17.209.142:80, 148.155.128.230:3991}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3991: (10%)&lt;BR/&gt; 3990: (10%)&lt;BR/&gt; 3987: (10%)&lt;BR/&gt; 3986: (10%)&gt;];
}
2166--2900[label="1;5pkt 5fpkt"];
2166--2942[label="1;5pkt 5fpkt"];
2166--3244[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="148.155.128.230" dst_port="3991" src_ip="207.17.209.142" src_port="80"/>
      <filter dst_ip="148.155.128.230" dst_port="3990" src_ip="207.17.209.142" src_port="80"/>
      <filter dst_ip="148.155.128.230" dst_port="3987" src_ip="207.17.209.142" src_port="80"/>
      <filter dst_ip="148.155.128.230" dst_port="3986" src_ip="207.17.209.142" src_port="80"/>
      <filter dst_ip="148.155.128.230" dst_port="3966" src_ip="207.17.209.142" src_port="80"/>
    </slice>
    <from sec="1041397585" usec="0"/>
    <to sec="1041397757" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.04205,1.95237,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_662{
style=filled;
color=gray75;
1883[label="144.52.18.6;s;246pkt 246fpkt", shape=diamond, color=yellow];
1958[label="208.128.149.70;d;211pkt 211fpkt", shape=diamond, color=yellow];
2906[label="144.52.18.6;s;246pkt 246fpkt", shape=hexagon, color=black];
3343[label="144.52.18.6;246pkt 246fpkt", shape=pentagon, color=darkviolet];
stat662[shape=component, label=&lt;Rules:&lt;BR/&gt;{144.52.18.6:*, 208.128.149.70:80}[85.7724%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.8419%)&lt;BR/&gt; 1308: (0.210748%)&lt;BR/&gt; 1307: (0.210748%)&lt;BR/&gt; 1306: (0.210748%)&lt;BR/&gt; 1305: (0.210748%)&gt;];
}
1883--1958[label="1;211pkt 211fpkt"];
1883--2906[label="1;246pkt 246fpkt"];
1883--3343[label="1;246pkt 246fpkt"];
1958--2906[label="1;211pkt 211fpkt"];
1958--3343[label="1;211pkt 211fpkt"];
2906--3343[label="1;246pkt 246fpkt"];
</description>
    <slice>
      <filter dst_ip="208.128.149.70" dst_port="80" src_ip="144.52.18.6"/>
    </slice>
    <from sec="1041397272" usec="0"/>
    <to sec="1041397755" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.17951,1.89871,999,1 1 1 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_663{
style=filled;
color=gray75;
404[label="210.226.80.147s;1pkt 1fpkt", shape=rectangle, color=red];
1008[label="210.226.80.147s;1pkt 1fpkt", shape=ellipse, color=green];
1460[label="210.226.80.147s;1pkt 1fpkt", shape=triangle, color=blue];
2170[label="90.76.100.147;s;1pkt 1fpkt", shape=diamond, color=yellow];
2910[label="90.76.100.147;s;1pkt 1fpkt", shape=hexagon, color=black];
stat663[shape=component, label=&lt;Rules:&lt;BR/&gt;{90.76.100.147:2648, 148.155.246.77:6346}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6346: (50%)&lt;BR/&gt; 2648: (50%)&gt;];
}
404--1008[label="1;1pkt 1fpkt"];
404--1460[label="1;1pkt 1fpkt"];
404--1628[label="1;1pkt 1fpkt"];
404--2170[label="1;1pkt 1fpkt"];
404--2726[label="1;1pkt 1fpkt"];
404--2910[label="1;1pkt 1fpkt"];
404--3213[label="1;1pkt 1fpkt"];
1008--1460[label="1;1pkt 1fpkt"];
1008--1628[label="1;1pkt 1fpkt"];
1008--2170[label="1;1pkt 1fpkt"];
1008--2726[label="1;1pkt 1fpkt"];
1008--2910[label="1;1pkt 1fpkt"];
1008--3213[label="1;1pkt 1fpkt"];
1460--1628[label="1;1pkt 1fpkt"];
1460--2170[label="1;1pkt 1fpkt"];
1460--2726[label="1;1pkt 1fpkt"];
1460--2910[label="1;1pkt 1fpkt"];
1460--3213[label="1;1pkt 1fpkt"];
2170--2726[label="1;1pkt 1fpkt"];
2170--2910[label="1;1pkt 1fpkt"];
2170--3213[label="1;1pkt 1fpkt"];
2910--3213[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="148.155.246.77" dst_port="6346" src_ip="90.76.100.147" src_port="2648"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.12182,1.93656,999,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_665{
style=filled;
color=gray75;
2174[label="172.142.204.157;s;2pkt 2fpkt", shape=diamond, color=yellow];
2175[label="195.49.71.36;d;1pkt 1fpkt", shape=diamond, color=yellow];
2949[label="195.49.71.36;d;1pkt 1fpkt", shape=hexagon, color=black];
2964[label="172.142.204.157;s;2pkt 2fpkt", shape=hexagon, color=black];
4046[label="172.142.204.157;2pkt 2fpkt", shape=pentagon, color=darkviolet];
4800[label="172.142.204.157;1pkt 1fpkt", shape=invtriangle, color=brown];
stat665[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.142.204.157:1924, 195.49.71.36:6667}[50%]&lt;BR/&gt;{172.142.204.157:1934, 207.17.12.248:5190}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (33.3333%)&lt;BR/&gt; 1924: (33.3333%)&lt;BR/&gt; 5190: (16.6667%)&lt;BR/&gt; 1934: (16.6667%)&gt;];
}
2174--2175[label="1;1pkt 1fpkt"];
2174--2949[label="1;1pkt 1fpkt"];
2174--2964[label="1;2pkt 2fpkt"];
2174--4046[label="1;2pkt 2fpkt"];
2174--4800[label="1;1pkt 1fpkt"];
2175--2949[label="1;1pkt 1fpkt"];
2175--2964[label="1;1pkt 1fpkt"];
2175--4046[label="1;1pkt 1fpkt"];
2175--4800[label="1;1pkt 1fpkt"];
2949--2964[label="1;1pkt 1fpkt"];
2949--4046[label="1;1pkt 1fpkt"];
2949--4800[label="1;1pkt 1fpkt"];
2964--4046[label="1;2pkt 2fpkt"];
2964--4800[label="1;1pkt 1fpkt"];
4046--4800[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="207.17.12.248" dst_port="5190" src_ip="172.142.204.157" src_port="1934"/>
      <filter dst_ip="195.49.71.36" dst_port="6667" src_ip="172.142.204.157" src_port="1924"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398817" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_666{
style=filled;
color=gray75;
2224[label="203.59.22.103;s;134pkt 134fpkt", shape=diamond, color=yellow];
2954[label="203.59.22.103;s;124pkt 124fpkt", shape=hexagon, color=black];
stat666[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.59.22.103:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
2224--2954[label="1;124pkt 124fpkt"];
</description>
    <slice>
      <filter src_ip="203.59.22.103"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398747" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.04205,1.95237,002,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_667{
style=filled;
color=gray75;
1857[label="131.211.33.75;d;6pkt 6fpkt", shape=diamond, color=yellow];
1858[label="131.198.151.237;s;2pkt 2fpkt", shape=diamond, color=yellow];
2768[label="131.198.151.237;s;1pkt 1fpkt", shape=hexagon, color=black];
2956[label="131.211.33.75;d;6pkt 6fpkt", shape=hexagon, color=black];
4350[label="131.198.151.237;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat667[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:137, 131.211.33.75:137}[50%]&lt;BR/&gt;{*:138, 131.211.33.75:138}[50%]&lt;BR/&gt;{131.198.116.104:*, 131.211.33.75:*}[33.3333%]&lt;BR/&gt;{131.198.122.156:*, 131.211.33.75:*}[33.3333%]&lt;BR/&gt;{131.198.151.237:*, 131.211.33.75:*}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 138: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
1857--1858[label="1;2pkt 2fpkt"];
1857--2768[label="1;1pkt 1fpkt"];
1857--2956[label="1;6pkt 6fpkt"];
1857--3276[label="0.166667;1pkt 1fpkt"];
1857--3280[label="0.333333;2pkt 2fpkt"];
1857--3285[label="0.166667;1pkt 1fpkt"];
1857--3290[label="0.166667;1pkt 1fpkt"];
1857--3295[label="0.333333;2pkt 2fpkt"];
1857--3299[label="0.166667;1pkt 1fpkt"];
1857--4350[label="1;1pkt 1fpkt"];
1858--2768[label="1;1pkt 1fpkt"];
1858--2956[label="1;2pkt 2fpkt"];
1858--3276[label="0.5;1pkt 1fpkt"];
1858--3280[label="0.5;1pkt 1fpkt"];
1858--3285[label="0.5;1pkt 1fpkt"];
1858--3290[label="0.5;1pkt 1fpkt"];
1858--3295[label="0.5;1pkt 1fpkt"];
1858--3299[label="0.5;1pkt 1fpkt"];
1858--4350[label="1;1pkt 1fpkt"];
2768--2956[label="1;1pkt 1fpkt"];
2768--3276[label="1;1pkt 1fpkt"];
2768--3280[label="1;1pkt 1fpkt"];
2768--3285[label="1;1pkt 1fpkt"];
2768--3290[label="1;1pkt 1fpkt"];
2768--3295[label="1;1pkt 1fpkt"];
2768--3299[label="1;1pkt 1fpkt"];
2956--3276[label="0.166667;1pkt 1fpkt"];
2956--3280[label="0.333333;2pkt 2fpkt"];
2956--3285[label="0.166667;1pkt 1fpkt"];
2956--3290[label="0.166667;1pkt 1fpkt"];
2956--3295[label="0.333333;2pkt 2fpkt"];
2956--3299[label="0.166667;1pkt 1fpkt"];
2956--4350[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="131.211.33.75" src_ip="131.198.151.237"/>
      <filter dst_ip="131.211.33.75" src_ip="131.198.122.156"/>
      <filter dst_ip="131.211.33.75" src_ip="131.198.116.104"/>
      <filter dst_ip="131.211.33.75" dst_port="138" src_port="138"/>
      <filter dst_ip="131.211.33.75" dst_port="137" src_port="137"/>
    </slice>
    <from sec="1041397201" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_668{
style=filled;
color=gray75;
1819[label="93.245.87.51;d;1pkt 1fpkt", shape=diamond, color=yellow];
2968[label="93.245.87.51;d;1pkt 1fpkt", shape=hexagon, color=black];
stat668[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.118.106:6699, 93.245.87.51:2190}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (50%)&lt;BR/&gt; 2190: (50%)&gt;];
}
1819--2968[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="93.245.87.51" dst_port="2190" src_ip="136.234.118.106" src_port="6699"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041397998" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_669{
style=filled;
color=gray75;
2188[label="172.142.201.140;s;56pkt 56fpkt", shape=diamond, color=yellow];
2975[label="172.142.201.140;s;54pkt 54fpkt", shape=hexagon, color=black];
stat669[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.142.201.140:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
2188--2975[label="1;54pkt 54fpkt"];
</description>
    <slice>
      <filter src_ip="172.142.201.140"/>
    </slice>
    <from sec="1041397202" usec="0"/>
    <to sec="1041398746" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_670{
style=filled;
color=gray75;
2280[label="148.4.130.101;d;110pkt 110fpkt", shape=diamond, color=yellow];
2980[label="148.4.130.101;d;110pkt 110fpkt", shape=hexagon, color=black];
stat670[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:53, 148.4.130.101:32773}[79.0909%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (46.3636%)&lt;BR/&gt; 32773: (42.2727%)&lt;BR/&gt; 50: (1.36364%)&lt;BR/&gt; 25: (1.36364%)&lt;BR/&gt; 51: (0.909091%)&gt;];
}
2280--2980[label="1;110pkt 110fpkt"];
2280--3274[label="0.0181818;2pkt 2fpkt"];
2280--3282[label="0.00909091;1pkt 1fpkt"];
2280--3288[label="0.0181818;2pkt 2fpkt"];
2280--3296[label="0.00909091;1pkt 1fpkt"];
2280--3297[label="0.0181818;2pkt 2fpkt"];
2280--3331[label="0.111111;1pkt 1fpkt"];
2280--3619[label="0.0769231;1pkt 1fpkt"];
2280--3712[label="0.0416667;1pkt 1fpkt"];
2280--3769[label="0.142857;1pkt 1fpkt"];
2280--4071[label="0.0294118;1pkt 1fpkt"];
2280--4327[label="0.0434783;1pkt 1fpkt"];
2980--3274[label="0.0181818;2pkt 2fpkt"];
2980--3282[label="0.00909091;1pkt 1fpkt"];
2980--3288[label="0.0181818;2pkt 2fpkt"];
2980--3296[label="0.00909091;1pkt 1fpkt"];
2980--3297[label="0.0181818;2pkt 2fpkt"];
2980--3331[label="0.111111;1pkt 1fpkt"];
2980--3619[label="0.0769231;1pkt 1fpkt"];
2980--3712[label="0.0416667;1pkt 1fpkt"];
2980--3769[label="0.142857;1pkt 1fpkt"];
2980--4071[label="0.0294118;1pkt 1fpkt"];
2980--4327[label="0.0434783;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="148.4.130.101" dst_port="32773" src_port="53"/>
    </slice>
    <from sec="1041397204" usec="0"/>
    <to sec="1041398730" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_671{
style=filled;
color=gray75;
1969[label="148.155.42.21;s;28pkt 28fpkt", shape=diamond, color=yellow];
2988[label="148.155.42.21;s;28pkt 28fpkt", shape=hexagon, color=black];
stat671[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.155.42.21:80, 89.97.129.97:*}[92.8571%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.2143%)&lt;BR/&gt; 32769: (1.78571%)&lt;BR/&gt; 4762: (1.78571%)&lt;BR/&gt; 4745: (1.78571%)&lt;BR/&gt; 4147: (1.78571%)&gt;];
}
1969--2988[label="1;28pkt 28fpkt"];
</description>
    <slice>
      <filter dst_ip="89.97.129.97" src_ip="148.155.42.21" src_port="80"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398741" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_672{
style=filled;
color=gray75;
2183[label="195.140.76.171;d;1pkt 1fpkt", shape=diamond, color=yellow];
2995[label="195.140.76.171;d;1pkt 1fpkt", shape=hexagon, color=black];
stat672[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.118.106:6699, 195.140.76.171:4971}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (50%)&lt;BR/&gt; 4971: (50%)&gt;];
}
2183--2995[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="195.140.76.171" dst_port="4971" src_ip="136.234.118.106" src_port="6699"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_673{
style=filled;
color=gray75;
2227[label="148.155.48.150;s;61pkt 61fpkt", shape=diamond, color=yellow];
2997[label="148.155.48.150;s;61pkt 61fpkt", shape=hexagon, color=black];
stat673[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.155.48.150:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
2227--2997[label="1;61pkt 61fpkt"];
</description>
    <slice>
      <filter src_ip="148.155.48.150"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.30601,1.97302,503,0 0 0 1 1 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_674{
style=filled;
color=gray75;
2298[label="148.155.247.8;d;1pkt 1fpkt", shape=diamond, color=yellow];
2301[label="63.119.66.202;s;1pkt 1fpkt", shape=diamond, color=yellow];
3003[label="63.119.66.202;s;1pkt 1fpkt", shape=hexagon, color=black];
4213[label="63.119.66.202;2pkt 2fpkt", shape=pentagon, color=darkviolet];
4895[label="63.119.66.202;3pkt 3fpkt", shape=invtriangle, color=brown];
5233[label="63.119.66.202;2pkt 2fpkt", shape=invhouse, color=bisque];
stat674[shape=component, label=&lt;Rules:&lt;BR/&gt;{63.119.66.202:47209, 148.155.247.8:80}[33.3333%]&lt;BR/&gt;{63.119.66.202:50402, 144.52.224.155:80}[33.3333%]&lt;BR/&gt;{63.119.66.202:55835, 144.52.224.155:80}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 47209: (30%)&lt;BR/&gt; 55835: (15%)&lt;BR/&gt; 50402: (5%)&gt;];
}
2298--2301[label="1;1pkt 1fpkt"];
2298--3003[label="1;1pkt 1fpkt"];
2298--4213[label="1;1pkt 1fpkt"];
2298--4895[label="1;1pkt 1fpkt"];
2298--5233[label="1;1pkt 1fpkt"];
2301--3003[label="1;1pkt 1fpkt"];
2301--4213[label="1;1pkt 1fpkt"];
2301--4895[label="1;1pkt 1fpkt"];
2301--5233[label="1;1pkt 1fpkt"];
3003--4213[label="1;1pkt 1fpkt"];
3003--4895[label="1;1pkt 1fpkt"];
3003--5233[label="1;1pkt 1fpkt"];
4213--4895[label="1;2pkt 2fpkt"];
4213--5233[label="1;2pkt 2fpkt"];
4895--5233[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="144.52.224.155" dst_port="80" src_ip="63.119.66.202" src_port="55835"/>
      <filter dst_ip="144.52.224.155" dst_port="80" src_ip="63.119.66.202" src_port="50402"/>
      <filter dst_ip="148.155.247.8" dst_port="80" src_ip="63.119.66.202" src_port="47209"/>
    </slice>
    <from sec="1041397723" usec="0"/>
    <to sec="1041398646" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_675{
style=filled;
color=gray75;
1779[label="90.211.108.212;d;1pkt 1fpkt", shape=diamond, color=yellow];
3009[label="90.211.108.212;d;1pkt 1fpkt", shape=hexagon, color=black];
stat675[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.162.210:6699, 90.211.108.212:4333}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (50%)&lt;BR/&gt; 4333: (50%)&gt;];
}
1779--3009[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="90.211.108.212" dst_port="4333" src_ip="136.234.162.210" src_port="6699"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_676{
style=filled;
color=gray75;
2367[label="213.168.25.24;d;1pkt 1fpkt", shape=diamond, color=yellow];
3011[label="213.168.25.24;d;1pkt 1fpkt", shape=hexagon, color=black];
stat676[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.145.223.55:6699, 213.168.25.24:2200}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (50%)&lt;BR/&gt; 2200: (50%)&gt;];
}
2367--3011[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="213.168.25.24" dst_port="2200" src_ip="202.145.223.55" src_port="6699"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11432,1.97571,503,0 0 0 1 1 0 0 0 0 0 1 0 ">
    <description>subgraph cluster_677{
style=filled;
color=gray75;
2321[label="211.123.159.115;d;210pkt 210fpkt", shape=diamond, color=yellow];
2322[label="168.125.147.196;s;210pkt 210fpkt", shape=diamond, color=yellow];
3018[label="211.123.159.115;d;136pkt 136fpkt", shape=hexagon, color=black];
4875[label="168.125.147.196;220pkt 220fpkt", shape=invtriangle, color=brown];
stat677[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.125.147.196:*, 211.123.159.115:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 57562: (0.257732%)&lt;BR/&gt; 57561: (0.257732%)&lt;BR/&gt; 57560: (0.257732%)&lt;BR/&gt; 57559: (0.257732%)&gt;];
}
2321--2322[label="1;210pkt 210fpkt"];
2321--3018[label="1;136pkt 136fpkt"];
2321--3275[label="0.0333333;7pkt 7fpkt"];
2321--3279[label="0.0428571;9pkt 9fpkt"];
2321--3283[label="0.0380952;8pkt 8fpkt"];
2321--3284[label="0.00952381;2pkt 2fpkt"];
2321--3289[label="0.0333333;7pkt 7fpkt"];
2321--3294[label="0.0428571;9pkt 9fpkt"];
2321--3298[label="0.0333333;7pkt 7fpkt"];
2321--4875[label="0.995238;209pkt 209fpkt"];
2322--3018[label="1;136pkt 136fpkt"];
2322--3275[label="0.0333333;7pkt 7fpkt"];
2322--3279[label="0.0428571;9pkt 9fpkt"];
2322--3283[label="0.0380952;8pkt 8fpkt"];
2322--3284[label="0.00952381;2pkt 2fpkt"];
2322--3289[label="0.0333333;7pkt 7fpkt"];
2322--3294[label="0.0428571;9pkt 9fpkt"];
2322--3298[label="0.0333333;7pkt 7fpkt"];
2322--4875[label="0.995238;209pkt 209fpkt"];
3018--3275[label="0.0514706;7pkt 7fpkt"];
3018--3289[label="0.0514706;7pkt 7fpkt"];
3018--3298[label="0.0514706;7pkt 7fpkt"];
3018--4875[label="0.992647;135pkt 135fpkt"];
</description>
    <slice>
      <filter dst_ip="211.123.159.115" dst_port="80" src_ip="168.125.147.196"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398820" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.12182,1.93656,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_678{
style=filled;
color=gray75;
2407[label="217.56.17.43;s;8pkt 8fpkt", shape=diamond, color=yellow];
3031[label="217.56.17.43;s;4pkt 4fpkt", shape=hexagon, color=black];
3535[label="217.56.17.43;8pkt 8fpkt", shape=pentagon, color=darkviolet];
4528[label="217.56.17.43;7pkt 7fpkt", shape=invtriangle, color=brown];
stat678[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.56.17.43:80, 136.234.170.208:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1600: (7.40741%)&lt;BR/&gt; 1595: (7.40741%)&lt;BR/&gt; 1583: (7.40741%)&lt;BR/&gt; 1644: (5.55556%)&gt;];
}
2407--3031[label="1;4pkt 4fpkt"];
2407--3535[label="1;8pkt 8fpkt"];
2407--4528[label="1;7pkt 7fpkt"];
3031--3535[label="1;4pkt 4fpkt"];
3031--4528[label="0.75;3pkt 3fpkt"];
3535--4528[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="136.234.170.208" src_ip="217.56.17.43" src_port="80"/>
    </slice>
    <from sec="1041398144" usec="0"/>
    <to sec="1041398268" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_679{
style=filled;
color=gray75;
2408[label="196.157.218.109;d;1pkt 1fpkt", shape=diamond, color=yellow];
3032[label="196.157.218.109;d;1pkt 1fpkt", shape=hexagon, color=black];
stat679[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.59.21.3:53, 196.157.218.109:3544}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3544: (50%)&lt;BR/&gt; 53: (50%)&gt;];
}
2408--3032[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="196.157.218.109" dst_port="3544" src_ip="203.59.21.3" src_port="53"/>
    </slice>
    <from sec="1041398145" usec="0"/>
    <to sec="1041398241" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_680{
style=filled;
color=gray75;
1905[label="148.144.206.45;s;1133pkt 1133fpkt", shape=diamond, color=yellow];
2049[label="145.117.103.184;d;376pkt 376fpkt", shape=diamond, color=yellow];
2091[label="141.0.187.243;d;373pkt 373fpkt", shape=diamond, color=yellow];
2143[label="141.0.32.228;d;349pkt 349fpkt", shape=diamond, color=yellow];
2846[label="145.117.103.184;d;113pkt 113fpkt", shape=hexagon, color=black];
2893[label="141.0.187.243;d;373pkt 373fpkt", shape=hexagon, color=black];
3037[label="141.0.32.228;d;241pkt 241fpkt", shape=hexagon, color=black];
3187[label="148.144.206.45;s;1133pkt 1133fpkt", shape=hexagon, color=black];
stat680[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.144.206.45:*, 145.117.103.184:2064}[33.1862%]&lt;BR/&gt;{148.144.206.45:*, 141.0.187.243:2064}[32.9214%]&lt;BR/&gt;{148.144.206.45:*, 141.0.32.228:2064}[30.8032%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2064: (49.1445%)&lt;BR/&gt; 43: (0.855537%)&lt;BR/&gt; 5000: (0.0488878%)&lt;BR/&gt; 4998: (0.0488878%)&lt;BR/&gt; 4997: (0.0488878%)&gt;];
}
1905--2049[label="1;376pkt 376fpkt"];
1905--2091[label="1;373pkt 373fpkt"];
1905--2143[label="1;349pkt 349fpkt"];
1905--2846[label="1;113pkt 113fpkt"];
1905--2893[label="1;373pkt 373fpkt"];
1905--3037[label="1;241pkt 241fpkt"];
1905--3187[label="1;1133pkt 1133fpkt"];
2049--2846[label="1;113pkt 113fpkt"];
2049--3187[label="1;376pkt 376fpkt"];
2091--2893[label="1;373pkt 373fpkt"];
2091--3187[label="1;373pkt 373fpkt"];
2143--3037[label="1;241pkt 241fpkt"];
2143--3187[label="1;349pkt 349fpkt"];
2846--3187[label="1;113pkt 113fpkt"];
2893--3187[label="1;373pkt 373fpkt"];
3037--3187[label="1;241pkt 241fpkt"];
</description>
    <slice>
      <filter dst_ip="145.117.103.184" dst_port="2064" src_ip="148.144.206.45"/>
      <filter dst_ip="141.0.187.243" dst_port="2064" src_ip="148.144.206.45"/>
      <filter dst_ip="141.0.32.228" dst_port="2064" src_ip="148.144.206.45"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.18661,1.85795,999,1 1 1 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_681{
style=filled;
color=gray75;
74[label="168.125.47.240s;2pkt 2fpkt", shape=rectangle, color=red];
1201[label="203.43.145.112d;1pkt 1fpkt", shape=ellipse, color=green];
1595[label="203.43.145.112d;1pkt 1fpkt", shape=triangle, color=blue];
1647[label="219.240.144.134;d;1pkt 1fpkt", shape=diamond, color=yellow];
1649[label="168.125.47.240;s;799pkt 799fpkt", shape=diamond, color=yellow];
1712[label="70.47.54.254;d;1pkt 1fpkt", shape=diamond, color=yellow];
1725[label="212.192.6.212;d;1pkt 1fpkt", shape=diamond, color=yellow];
1726[label="70.161.33.221;d;1pkt 1fpkt", shape=diamond, color=yellow];
1751[label="219.40.154.198;d;1pkt 1fpkt", shape=diamond, color=yellow];
1846[label="219.254.217.223;d;56pkt 56fpkt", shape=diamond, color=yellow];
1896[label="4.166.121.117;d;1pkt 1fpkt", shape=diamond, color=yellow];
1901[label="219.43.48.47;d;1pkt 1fpkt", shape=diamond, color=yellow];
1927[label="70.115.138.95;d;1pkt 1fpkt", shape=diamond, color=yellow];
1965[label="219.148.75.77;d;2pkt 2fpkt", shape=diamond, color=yellow];
2248[label="219.12.71.18;d;1pkt 1fpkt", shape=diamond, color=yellow];
2249[label="194.189.228.85;d;1pkt 1fpkt", shape=diamond, color=yellow];
2259[label="70.56.77.239;d;1pkt 1fpkt", shape=diamond, color=yellow];
2303[label="62.54.86.55;d;2pkt 2fpkt", shape=diamond, color=yellow];
2306[label="4.22.13.138;d;1pkt 1fpkt", shape=diamond, color=yellow];
2507[label="62.131.241.10;d;1pkt 1fpkt", shape=diamond, color=yellow];
2509[label="71.233.240.249;d;1pkt 1fpkt", shape=diamond, color=yellow];
2555[label="90.93.122.23;d;1pkt 1fpkt", shape=diamond, color=yellow];
2657[label="90.93.114.10;d;1pkt 1fpkt", shape=diamond, color=yellow];
2808[label="70.47.54.254;d;1pkt 1fpkt", shape=hexagon, color=black];
2811[label="212.192.6.212;d;1pkt 1fpkt", shape=hexagon, color=black];
2989[label="219.43.48.47;d;1pkt 1fpkt", shape=hexagon, color=black];
3042[label="168.125.47.240;s;672pkt 672fpkt", shape=hexagon, color=black];
3151[label="70.56.77.239;d;1pkt 1fpkt", shape=hexagon, color=black];
3200[label="62.54.86.55;d;2pkt 2fpkt", shape=hexagon, color=black];
4356[label="168.125.47.240;865pkt 865fpkt", shape=pentagon, color=darkviolet];
stat681[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.125.47.240:*, *:4662}[80.578%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4662: (40.8753%)&lt;BR/&gt; 1274: (4.62428%)&lt;BR/&gt; 4665: (3.55078%)&lt;BR/&gt; 4661: (1.34187%)&lt;BR/&gt; 80: (0.45417%)&gt;];
}
74--1649[label="1;2pkt 2fpkt"];
74--1712[label="1;1pkt 1fpkt"];
74--1726[label="1;1pkt 1fpkt"];
74--2808[label="1;1pkt 1fpkt"];
74--3042[label="1;2pkt 2fpkt"];
74--4356[label="1;2pkt 2fpkt"];
1201--1595[label="1;1pkt 1fpkt"];
1201--1649[label="1;1pkt 1fpkt"];
1201--4356[label="1;1pkt 1fpkt"];
1595--1649[label="1;1pkt 1fpkt"];
1595--4356[label="1;1pkt 1fpkt"];
1647--1649[label="1;1pkt 1fpkt"];
1647--3042[label="1;1pkt 1fpkt"];
1647--4356[label="1;1pkt 1fpkt"];
1649--1712[label="1;1pkt 1fpkt"];
1649--1725[label="1;1pkt 1fpkt"];
1649--1726[label="1;1pkt 1fpkt"];
1649--1751[label="1;1pkt 1fpkt"];
1649--1846[label="1;56pkt 56fpkt"];
1649--1896[label="1;1pkt 1fpkt"];
1649--1901[label="1;1pkt 1fpkt"];
1649--1927[label="1;1pkt 1fpkt"];
1649--1965[label="1;2pkt 2fpkt"];
1649--2248[label="1;1pkt 1fpkt"];
1649--2249[label="1;1pkt 1fpkt"];
1649--2259[label="1;1pkt 1fpkt"];
1649--2303[label="1;2pkt 2fpkt"];
1649--2306[label="1;1pkt 1fpkt"];
1649--2507[label="1;1pkt 1fpkt"];
1649--2509[label="1;1pkt 1fpkt"];
1649--2555[label="1;1pkt 1fpkt"];
1649--2657[label="1;1pkt 1fpkt"];
1649--2808[label="1;1pkt 1fpkt"];
1649--2811[label="1;1pkt 1fpkt"];
1649--2989[label="1;1pkt 1fpkt"];
1649--3042[label="1;672pkt 672fpkt"];
1649--3151[label="1;1pkt 1fpkt"];
1649--3200[label="1;2pkt 2fpkt"];
1649--4356[label="1;799pkt 799fpkt"];
1712--2808[label="1;1pkt 1fpkt"];
1712--3042[label="1;1pkt 1fpkt"];
1712--4356[label="1;1pkt 1fpkt"];
1725--2811[label="1;1pkt 1fpkt"];
1725--3042[label="1;1pkt 1fpkt"];
1725--4356[label="1;1pkt 1fpkt"];
1726--3042[label="1;1pkt 1fpkt"];
1726--4356[label="1;1pkt 1fpkt"];
1751--3042[label="1;1pkt 1fpkt"];
1751--4356[label="1;1pkt 1fpkt"];
1846--3042[label="0.660714;37pkt 37fpkt"];
1846--4356[label="1;56pkt 56fpkt"];
1896--3042[label="1;1pkt 1fpkt"];
1896--4356[label="1;1pkt 1fpkt"];
1901--2989[label="1;1pkt 1fpkt"];
1901--3042[label="1;1pkt 1fpkt"];
1901--4356[label="1;1pkt 1fpkt"];
1927--3042[label="1;1pkt 1fpkt"];
1927--4356[label="1;1pkt 1fpkt"];
1965--3042[label="1;2pkt 2fpkt"];
1965--4356[label="1;2pkt 2fpkt"];
2248--3042[label="1;1pkt 1fpkt"];
2248--4356[label="1;1pkt 1fpkt"];
2249--3042[label="1;1pkt 1fpkt"];
2249--4356[label="1;1pkt 1fpkt"];
2259--3042[label="1;1pkt 1fpkt"];
2259--3151[label="1;1pkt 1fpkt"];
2259--4356[label="1;1pkt 1fpkt"];
2303--3042[label="1;2pkt 2fpkt"];
2303--3200[label="1;2pkt 2fpkt"];
2303--4356[label="1;2pkt 2fpkt"];
2306--3042[label="1;1pkt 1fpkt"];
2306--4356[label="1;1pkt 1fpkt"];
2507--3042[label="1;1pkt 1fpkt"];
2507--4356[label="1;1pkt 1fpkt"];
2509--3042[label="1;1pkt 1fpkt"];
2509--4356[label="1;1pkt 1fpkt"];
2555--3042[label="1;1pkt 1fpkt"];
2555--4356[label="1;1pkt 1fpkt"];
2657--3042[label="1;1pkt 1fpkt"];
2657--4356[label="1;1pkt 1fpkt"];
2808--3042[label="1;1pkt 1fpkt"];
2808--4356[label="1;1pkt 1fpkt"];
2811--3042[label="1;1pkt 1fpkt"];
2811--4356[label="1;1pkt 1fpkt"];
2989--3042[label="1;1pkt 1fpkt"];
2989--4356[label="1;1pkt 1fpkt"];
3042--3151[label="1;1pkt 1fpkt"];
3042--3200[label="1;2pkt 2fpkt"];
3042--4356[label="1;672pkt 672fpkt"];
3151--4356[label="1;1pkt 1fpkt"];
3200--4356[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_port="4662" src_ip="168.125.47.240"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_682{
style=filled;
color=gray75;
2043[label="219.250.51.48;d;1pkt 1fpkt", shape=diamond, color=yellow];
3043[label="219.250.51.48;d;1pkt 1fpkt", shape=hexagon, color=black];
stat682[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.155.247.29:6970, 219.250.51.48:65112}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 65112: (50%)&lt;BR/&gt; 6970: (50%)&gt;];
}
2043--3043[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="219.250.51.48" dst_port="65112" src_ip="148.155.247.29" src_port="6970"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_684{
style=filled;
color=gray75;
1950[label="172.142.201.149;s;982pkt 982fpkt", shape=diamond, color=yellow];
2212[label="202.233.156.63;d;1pkt 1fpkt", shape=diamond, color=yellow];
3054[label="172.142.201.149;s;941pkt 941fpkt", shape=hexagon, color=black];
stat684[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.142.201.149:*, *:25}[76.6802%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (44.4647%)&lt;BR/&gt; 113: (2.9106%)&lt;BR/&gt; 80: (2.46881%)&lt;BR/&gt; 0: (0.31185%)&lt;BR/&gt; 4964: (0.155925%)&gt;];
}
1950--2212[label="1;1pkt 1fpkt"];
1950--2585[label="0.0425532;2pkt 2fpkt"];
1950--2697[label="0.025;1pkt 1fpkt"];
1950--3054[label="1;941pkt 941fpkt"];
2212--3054[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="25" src_ip="172.142.201.149"/>
    </slice>
    <from sec="1041397203" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_685{
style=filled;
color=gray75;
2477[label="210.208.102.73;d;71pkt 71fpkt", shape=diamond, color=yellow];
3058[label="210.208.102.73;d;71pkt 71fpkt", shape=hexagon, color=black];
stat685[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.159.192.25:*, 210.208.102.73:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 32696: (0.704225%)&lt;BR/&gt; 32341: (0.704225%)&lt;BR/&gt; 32226: (0.704225%)&lt;BR/&gt; 32162: (0.704225%)&gt;];
}
2477--2797[label="1;71pkt 71fpkt"];
2477--3058[label="1;71pkt 71fpkt"];
2477--3275[label="0.028169;2pkt 2fpkt"];
2477--3289[label="0.028169;2pkt 2fpkt"];
2477--3298[label="0.028169;2pkt 2fpkt"];
3058--3275[label="0.028169;2pkt 2fpkt"];
3058--3289[label="0.028169;2pkt 2fpkt"];
3058--3298[label="0.028169;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="210.208.102.73" dst_port="80" src_ip="202.159.192.25"/>
    </slice>
    <from sec="1041397208" usec="0"/>
    <to sec="1041398449" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_686{
style=filled;
color=gray75;
2508[label="90.93.122.23;s;1pkt 1fpkt", shape=diamond, color=yellow];
3067[label="90.93.122.23;s;1pkt 1fpkt", shape=hexagon, color=black];
stat686[shape=component, label=&lt;Rules:&lt;BR/&gt;{90.93.122.23:4662, 168.125.47.240:2433}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4662: (50%)&lt;BR/&gt; 2433: (50%)&gt;];
}
2508--3067[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="168.125.47.240" dst_port="2433" src_ip="90.93.122.23" src_port="4662"/>
    </slice>
    <from sec="1041398282" usec="0"/>
    <to sec="1041398658" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_687{
style=filled;
color=gray75;
1722[label="195.35.72.243;d;4pkt 4fpkt", shape=diamond, color=yellow];
3072[label="195.35.72.243;d;4pkt 4fpkt", shape=hexagon, color=black];
stat687[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.59.18.72:21, 195.35.72.243:4559}[25%]&lt;BR/&gt;{203.59.18.72:20, 195.35.72.243:2125}[25%]&lt;BR/&gt;{203.59.18.72:20, 195.35.72.243:3115}[25%]&lt;BR/&gt;{203.59.18.72:20, 195.35.72.243:3736}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 20: (37.5%)&lt;BR/&gt; 4559: (12.5%)&lt;BR/&gt; 3736: (12.5%)&lt;BR/&gt; 3115: (12.5%)&lt;BR/&gt; 2125: (12.5%)&gt;];
}
1722--3072[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="195.35.72.243" dst_port="3736" src_ip="203.59.18.72" src_port="20"/>
      <filter dst_ip="195.35.72.243" dst_port="3115" src_ip="203.59.18.72" src_port="20"/>
      <filter dst_ip="195.35.72.243" dst_port="2125" src_ip="203.59.18.72" src_port="20"/>
      <filter dst_ip="195.35.72.243" dst_port="4559" src_ip="203.59.18.72" src_port="21"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_689{
style=filled;
color=gray75;
2424[label="206.24.84.21;d;1pkt 1fpkt", shape=diamond, color=yellow];
2470[label="172.142.204.64;s;1pkt 1fpkt", shape=diamond, color=yellow];
3088[label="206.24.84.21;d;1pkt 1fpkt", shape=hexagon, color=black];
stat689[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.142.204.64:2138, 206.24.84.21:5001}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5001: (50%)&lt;BR/&gt; 2138: (50%)&gt;];
}
2424--2470[label="1;1pkt 1fpkt"];
2424--3088[label="1;1pkt 1fpkt"];
2470--3088[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="206.24.84.21" dst_port="5001" src_ip="172.142.204.64" src_port="2138"/>
    </slice>
    <from sec="1041397203" usec="0"/>
    <to sec="1041398744" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_690{
style=filled;
color=gray75;
2532[label="208.145.87.231;d;1pkt 1fpkt", shape=diamond, color=yellow];
3091[label="208.145.87.231;d;1pkt 1fpkt", shape=hexagon, color=black];
stat690[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.196.63:6699, 208.145.87.231:2830}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (50%)&lt;BR/&gt; 2830: (50%)&gt;];
}
2532--3091[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="208.145.87.231" dst_port="2830" src_ip="136.234.196.63" src_port="6699"/>
    </slice>
    <from sec="1041397212" usec="0"/>
    <to sec="1041398742" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_691{
style=filled;
color=gray75;
1659[label="136.234.162.210;s;334pkt 334fpkt", shape=diamond, color=yellow];
1783[label="88.65.154.28;d;1pkt 1fpkt", shape=diamond, color=yellow];
2353[label="62.201.59.149;d;2pkt 2fpkt", shape=diamond, color=yellow];
2442[label="93.244.156.18;d;2pkt 2fpkt", shape=diamond, color=yellow];
3098[label="93.244.156.18;d;2pkt 2fpkt", shape=hexagon, color=black];
stat691[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.162.210:6257, *:6257}[96.1078%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6257: (95.3079%)&lt;BR/&gt; 6699: (2.19941%)&lt;BR/&gt; 1364: (0.439883%)&lt;BR/&gt; 16257: (0.293255%)&lt;BR/&gt; 2310: (0.293255%)&gt;];
}
1659--1779[label="1;1pkt 1fpkt"];
1659--1783[label="1;1pkt 1fpkt"];
1659--2353[label="1;2pkt 2fpkt"];
1659--2442[label="1;2pkt 2fpkt"];
1659--3009[label="1;1pkt 1fpkt"];
1659--3098[label="1;2pkt 2fpkt"];
1659--3277[label="0.0479042;16pkt 16fpkt"];
1659--3281[label="0.185629;62pkt 62fpkt"];
1659--3286[label="0.0688623;23pkt 23fpkt"];
1659--3291[label="0.0479042;16pkt 16fpkt"];
1659--3300[label="0.0479042;16pkt 16fpkt"];
2442--3098[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_port="6257" src_ip="136.234.162.210" src_port="6257"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_692{
style=filled;
color=gray75;
1829[label="172.142.200.68;s;4pkt 4fpkt", shape=diamond, color=yellow];
1916[label="88.233.178.142;d;4pkt 4fpkt", shape=diamond, color=yellow];
3104[label="88.233.178.142;d;3pkt 3fpkt", shape=hexagon, color=black];
stat692[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.142.200.68:80, 88.233.178.142:61494}[25%]&lt;BR/&gt;{172.142.200.68:80, 88.233.178.142:64449}[25%]&lt;BR/&gt;{172.142.200.68:80, 88.233.178.142:64456}[25%]&lt;BR/&gt;{172.142.200.68:80, 88.233.178.142:64577}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 64577: (13.6364%)&lt;BR/&gt; 64456: (13.6364%)&lt;BR/&gt; 64449: (13.6364%)&lt;BR/&gt; 61494: (9.09091%)&gt;];
}
1829--1916[label="1;4pkt 4fpkt"];
1829--3104[label="1;3pkt 3fpkt"];
1916--3104[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="88.233.178.142" dst_port="64577" src_ip="172.142.200.68" src_port="80"/>
      <filter dst_ip="88.233.178.142" dst_port="64456" src_ip="172.142.200.68" src_port="80"/>
      <filter dst_ip="88.233.178.142" dst_port="64449" src_ip="172.142.200.68" src_port="80"/>
      <filter dst_ip="88.233.178.142" dst_port="61494" src_ip="172.142.200.68" src_port="80"/>
    </slice>
    <from sec="1041398251" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_693{
style=filled;
color=gray75;
2313[label="209.122.47.243;d;1pkt 1fpkt", shape=diamond, color=yellow];
3110[label="209.122.47.243;d;1pkt 1fpkt", shape=hexagon, color=black];
stat693[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.155.247.29:6970, 209.122.47.243:4821}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6970: (50%)&lt;BR/&gt; 4821: (50%)&gt;];
}
2313--3110[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="209.122.47.243" dst_port="4821" src_ip="148.155.247.29" src_port="6970"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398746" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_694{
style=filled;
color=gray75;
2317[label="209.69.248.210;d;1pkt 1fpkt", shape=diamond, color=yellow];
3115[label="209.69.248.210;d;1pkt 1fpkt", shape=hexagon, color=black];
stat694[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.196.63:6699, 209.69.248.210:10927}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 10927: (50%)&lt;BR/&gt; 6699: (50%)&gt;];
}
2317--3115[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="209.69.248.210" dst_port="10927" src_ip="136.234.196.63" src_port="6699"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398743" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_695{
style=filled;
color=gray75;
2573[label="203.59.22.121;d;49pkt 49fpkt", shape=diamond, color=yellow];
3119[label="203.59.22.121;d;49pkt 49fpkt", shape=hexagon, color=black];
stat695[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 203.59.22.121:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
2573--3119[label="1;49pkt 49fpkt"];
</description>
    <slice>
      <filter dst_ip="203.59.22.121"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398747" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.30601,1.97302,999,0 0 0 1 1 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_696{
style=filled;
color=gray75;
2589[label="192.229.192.146;s;53pkt 53fpkt", shape=diamond, color=yellow];
3135[label="192.229.192.146;s;53pkt 53fpkt", shape=hexagon, color=black];
3998[label="192.229.192.146;52pkt 52fpkt", shape=pentagon, color=darkviolet];
4773[label="192.229.192.146;52pkt 52fpkt", shape=invtriangle, color=brown];
5176[label="192.229.192.146;52pkt 52fpkt", shape=invhouse, color=bisque];
stat696[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.229.192.146:6667, *:*}[37.7358%]&lt;BR/&gt;{192.229.192.146:*, *:113}[32.0755%]&lt;BR/&gt;{192.229.192.146:*, 213.48.140.84:*}[30.1887%]&lt;BR/&gt;{192.229.192.146:*, 203.72.192.247:*}[22.6415%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (18.5115%)&lt;BR/&gt; 113: (16.2214%)&lt;BR/&gt; 10080: (1.9084%)&lt;BR/&gt; 8080: (1.9084%)&lt;BR/&gt; 6668: (1.9084%)&gt;];
}
2589--3135[label="1;53pkt 53fpkt"];
2589--3998[label="1;52pkt 52fpkt"];
2589--4773[label="1;52pkt 52fpkt"];
2589--5176[label="1;52pkt 52fpkt"];
3135--3998[label="1;52pkt 52fpkt"];
3135--4773[label="1;52pkt 52fpkt"];
3135--5176[label="1;52pkt 52fpkt"];
3998--4773[label="1;52pkt 52fpkt"];
3998--5176[label="1;52pkt 52fpkt"];
4773--5176[label="1;52pkt 52fpkt"];
</description>
    <slice>
      <filter dst_ip="213.48.140.84" src_ip="192.229.192.146"/>
      <filter dst_ip="203.72.192.247" src_ip="192.229.192.146"/>
      <filter src_ip="192.229.192.146" src_port="6667"/>
      <filter dst_port="113" src_ip="192.229.192.146"/>
    </slice>
    <from sec="1041397211" usec="0"/>
    <to sec="1041398818" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_697{
style=filled;
color=gray75;
2604[label="89.116.38.229;d;1pkt 1fpkt", shape=diamond, color=yellow];
3141[label="89.116.38.229;d;1pkt 1fpkt", shape=hexagon, color=black];
stat697[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.119.19:1412, 89.116.38.229:2136}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2136: (50%)&lt;BR/&gt; 1412: (50%)&gt;];
}
2604--3141[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="89.116.38.229" dst_port="2136" src_ip="136.234.119.19" src_port="1412"/>
    </slice>
    <from sec="1041398300" usec="0"/>
    <to sec="1041398548" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.04205,1.95237,020,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_698{
style=filled;
color=gray75;
2482[label="170.9.203.192;s;41pkt 41fpkt", shape=diamond, color=yellow];
3163[label="170.9.203.192;s;41pkt 41fpkt", shape=hexagon, color=black];
4169[label="170.9.203.192;42pkt 42fpkt", shape=pentagon, color=darkviolet];
stat698[shape=component, label=&lt;Rules:&lt;BR/&gt;{170.9.203.192:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
2482--3163[label="1;41pkt 41fpkt"];
2482--4169[label="0.97561;40pkt 40fpkt"];
3163--4169[label="0.97561;40pkt 40fpkt"];
</description>
    <slice>
      <filter src_ip="170.9.203.192"/>
    </slice>
    <from sec="1041397271" usec="0"/>
    <to sec="1041398794" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_699{
style=filled;
color=gray75;
2546[label="212.143.74.5;s;1pkt 1fpkt", shape=diamond, color=yellow];
3174[label="212.143.74.5;s;2pkt 2fpkt", shape=hexagon, color=black];
stat699[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.143.74.5:4662, 202.159.194.17:3209}[50%]&lt;BR/&gt;{212.143.74.5:4662, 202.159.194.17:3435}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4662: (50%)&lt;BR/&gt; 3435: (33.3333%)&lt;BR/&gt; 3209: (16.6667%)&gt;];
}
2546--3174[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="202.159.194.17" dst_port="3435" src_ip="212.143.74.5" src_port="4662"/>
      <filter dst_ip="202.159.194.17" dst_port="3209" src_ip="212.143.74.5" src_port="4662"/>
    </slice>
    <from sec="1041398047" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_700{
style=filled;
color=gray75;
2666[label="23.236.244.77;d;1pkt 1fpkt", shape=diamond, color=yellow];
3179[label="23.236.244.77;d;1pkt 1fpkt", shape=hexagon, color=black];
stat700[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.119.19:1412, 23.236.244.77:2763}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2763: (50%)&lt;BR/&gt; 1412: (50%)&gt;];
}
2666--3179[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="23.236.244.77" dst_port="2763" src_ip="136.234.119.19" src_port="1412"/>
    </slice>
    <from sec="1041398431" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03396,1.99121,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_701{
style=filled;
color=gray75;
1788[label="62.137.212.200;d;1pkt 1fpkt", shape=diamond, color=yellow];
3185[label="62.137.212.200;d;1pkt 1fpkt", shape=hexagon, color=black];
stat701[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.196.63:6699, 62.137.212.200:3594}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (50%)&lt;BR/&gt; 3594: (50%)&gt;];
}
1788--3185[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="62.137.212.200" dst_port="3594" src_ip="136.234.196.63" src_port="6699"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.18661,1.85795,999,1 1 1 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_702{
style=filled;
color=gray75;
124[label="217.128.76.13s;1pkt 1fpkt", shape=rectangle, color=red];
127[label="211.234.200.13s;1pkt 1fpkt", shape=rectangle, color=red];
782[label="217.128.76.13s;1pkt 1fpkt", shape=ellipse, color=green];
1294[label="217.128.76.13s;1pkt 1fpkt", shape=triangle, color=blue];
2661[label="193.117.0.13;s;1pkt 1fpkt", shape=diamond, color=yellow];
3209[label="193.117.0.13;s;1pkt 1fpkt", shape=hexagon, color=black];
3385[label="193.117.0.13;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat702[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.117.0.13:4662, 168.125.205.3:3221}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4662: (50%)&lt;BR/&gt; 3221: (50%)&gt;];
}
124--127[label="1;1pkt 1fpkt"];
124--782[label="1;1pkt 1fpkt"];
124--1294[label="1;1pkt 1fpkt"];
124--1891[label="1;1pkt 1fpkt"];
124--2661[label="1;1pkt 1fpkt"];
124--2963[label="1;1pkt 1fpkt"];
124--3209[label="1;1pkt 1fpkt"];
124--3250[label="1;1pkt 1fpkt"];
124--3385[label="1;1pkt 1fpkt"];
127--782[label="1;1pkt 1fpkt"];
127--1294[label="1;1pkt 1fpkt"];
127--1891[label="1;1pkt 1fpkt"];
127--2661[label="1;1pkt 1fpkt"];
127--2963[label="1;1pkt 1fpkt"];
127--3209[label="1;1pkt 1fpkt"];
127--3250[label="1;1pkt 1fpkt"];
127--3385[label="1;1pkt 1fpkt"];
782--1294[label="1;1pkt 1fpkt"];
782--1891[label="1;1pkt 1fpkt"];
782--2661[label="1;1pkt 1fpkt"];
782--2963[label="1;1pkt 1fpkt"];
782--3209[label="1;1pkt 1fpkt"];
782--3250[label="1;1pkt 1fpkt"];
782--3385[label="1;1pkt 1fpkt"];
1294--1891[label="1;1pkt 1fpkt"];
1294--2661[label="1;1pkt 1fpkt"];
1294--2963[label="1;1pkt 1fpkt"];
1294--3209[label="1;1pkt 1fpkt"];
1294--3250[label="1;1pkt 1fpkt"];
1294--3385[label="1;1pkt 1fpkt"];
2661--2963[label="1;1pkt 1fpkt"];
2661--3209[label="1;1pkt 1fpkt"];
2661--3250[label="1;1pkt 1fpkt"];
2661--3385[label="1;1pkt 1fpkt"];
3209--3250[label="1;1pkt 1fpkt"];
3209--3385[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="168.125.205.3" dst_port="3221" src_ip="193.117.0.13" src_port="4662"/>
    </slice>
    <from sec="1041397517" usec="0"/>
    <to sec="1041398822" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757634,1.96858,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_710{
style=filled;
color=gray75;
2327[label="172.142.141.216;d;55pkt 55fpkt", shape=diamond, color=yellow];
stat710[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:25, 172.142.141.216:*}[92.7273%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (46.3636%)&lt;BR/&gt; 113: (2.72727%)&lt;BR/&gt; 137: (1.81818%)&lt;BR/&gt; 57306: (0.909091%)&lt;BR/&gt; 48129: (0.909091%)&gt;];
}
2327--3035[label="1;49pkt 49fpkt"];
2327--3727[label="0.666667;2pkt 2fpkt"];
2327--3932[label="0.0263158;1pkt 1fpkt"];
2327--4622[label="0.5;2pkt 2fpkt"];
2327--5105[label="0.5;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="172.142.141.216" src_port="25"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398707" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="90.2.76.0"/>
    </slice>
    <from sec="1041397208" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.960376,1.95263,002,1 0 0 0 0 0 0 0 0 0 1 1 ">
    <description>subgraph cluster_712{
style=filled;
color=gray75;
91[label="217.128.173.0s;164pkt 164fpkt", shape=rectangle, color=red];
4403[label="217.128.173.0;163pkt 163fpkt", shape=invtriangle, color=brown];
4992[label="217.128.173.0;164pkt 164fpkt", shape=invhouse, color=bisque];
stat712[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.128.173.0:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
91--3305[label="1;163pkt 163fpkt"];
91--4403[label="1;163pkt 163fpkt"];
91--4992[label="1;164pkt 164fpkt"];
4403--4992[label="1;163pkt 163fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.128.173.0" src_port="1025"/>
    </slice>
    <from sec="1041397792" usec="0"/>
    <to sec="1041397822" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="148.138.205.0"/>
    </slice>
    <from sec="1041398019" usec="0"/>
    <to sec="1041398047" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="213.105.49.1"/>
    </slice>
    <from sec="1041397483" usec="0"/>
    <to sec="1041397540" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.125.103.1"/>
    </slice>
    <from sec="1041398226" usec="0"/>
    <to sec="1041398231" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.140.57.2"/>
    </slice>
    <from sec="1041398357" usec="0"/>
    <to sec="1041398793" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="193.95.126.2"/>
    </slice>
    <from sec="1041398303" usec="0"/>
    <to sec="1041398316" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_718{
style=filled;
color=gray75;
508[label="88.114.104.197s;226pkt 226fpkt", shape=rectangle, color=red];
1088[label="88.114.104.197s;226pkt 226fpkt", shape=ellipse, color=green];
1514[label="88.114.104.197s;363pkt 363fpkt", shape=triangle, color=blue];
3320[label="211.168.173.2;121pkt 121fpkt", shape=pentagon, color=darkviolet];
4189[label="88.114.104.197;150pkt 150fpkt", shape=pentagon, color=darkviolet];
4413[label="211.168.173.2;121pkt 121fpkt", shape=invtriangle, color=brown];
stat718[shape=component, label=&lt;Rules:&lt;BR/&gt;{88.114.104.197:1027, *:137}[37.0732%]&lt;BR/&gt;{61.82.80.69:1028, *:137}[33.4146%]&lt;BR/&gt;{211.168.173.2:1028, *:137}[29.5122%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 1027: (25.1036%)&lt;BR/&gt; 1028: (24.8964%)&gt;];
}
508--1088[label="1;226pkt 226fpkt"];
508--1514[label="1;226pkt 226fpkt"];
508--3320[label="0.61157;74pkt 74fpkt"];
508--4189[label="1;150pkt 150fpkt"];
508--4413[label="0.61157;74pkt 74fpkt"];
1088--1514[label="1;226pkt 226fpkt"];
1088--3320[label="0.61157;74pkt 74fpkt"];
1088--4189[label="1;150pkt 150fpkt"];
1088--4413[label="0.61157;74pkt 74fpkt"];
1514--3320[label="0.61157;74pkt 74fpkt"];
1514--4189[label="1;150pkt 150fpkt"];
1514--4413[label="0.61157;74pkt 74fpkt"];
3320--4413[label="1;121pkt 121fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="88.114.104.197" src_port="1027"/>
      <filter dst_port="137" src_ip="61.82.80.69" src_port="1028"/>
      <filter dst_port="137" src_ip="211.168.173.2" src_port="1028"/>
    </slice>
    <from sec="1041397504" usec="0"/>
    <to sec="1041397546" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.100.214.3"/>
    </slice>
    <from sec="1041398379" usec="0"/>
    <to sec="1041398416" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.126.220.4"/>
    </slice>
    <from sec="1041398412" usec="0"/>
    <to sec="1041398448" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.701377,1.87539,002,1 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_722{
style=filled;
color=gray75;
108[label="61.206.117.5s;146pkt 146fpkt", shape=rectangle, color=red];
3337[label="61.206.117.5;173pkt 173fpkt", shape=pentagon, color=darkviolet];
4422[label="61.206.117.5;174pkt 174fpkt", shape=invtriangle, color=brown];
stat722[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.206.117.5:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
108--3337[label="0.993151;145pkt 145fpkt"];
108--4422[label="1;146pkt 146fpkt"];
3337--4422[label="1;173pkt 173fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.206.117.5" src_port="1027"/>
    </slice>
    <from sec="1041397989" usec="0"/>
    <to sec="1041398016" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.969076,1.91301,002,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_723{
style=filled;
color=gray75;
109[label="61.137.167.5s;156pkt 156fpkt", shape=rectangle, color=red];
3341[label="61.137.167.5;220pkt 220fpkt", shape=pentagon, color=darkviolet];
4425[label="61.137.167.5;220pkt 220fpkt", shape=invtriangle, color=brown];
4998[label="61.137.167.5;220pkt 220fpkt", shape=invhouse, color=bisque];
stat723[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.137.167.5:1030, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1030: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
109--3341[label="1;156pkt 156fpkt"];
109--4425[label="1;156pkt 156fpkt"];
109--4998[label="1;156pkt 156fpkt"];
3341--4425[label="1;220pkt 220fpkt"];
3341--4998[label="1;220pkt 220fpkt"];
4425--4998[label="1;220pkt 220fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.137.167.5" src_port="1030"/>
    </slice>
    <from sec="1041397816" usec="0"/>
    <to sec="1041397859" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.59.21.6"/>
    </slice>
    <from sec="1041398466" usec="0"/>
    <to sec="1041398491" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="61.233.91.6"/>
    </slice>
    <from sec="1041397208" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_726{
style=filled;
color=gray75;
115[label="91.105.125.8s;126pkt 126fpkt", shape=rectangle, color=red];
774[label="91.105.125.8s;126pkt 126fpkt", shape=ellipse, color=green];
1286[label="91.105.125.8s;126pkt 126fpkt", shape=triangle, color=blue];
3359[label="91.105.125.8;155pkt 155fpkt", shape=pentagon, color=darkviolet];
4435[label="91.105.125.8;155pkt 155fpkt", shape=invtriangle, color=brown];
5004[label="91.105.125.8;155pkt 155fpkt", shape=invhouse, color=bisque];
stat726[shape=component, label=&lt;Rules:&lt;BR/&gt;{91.105.125.8:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
115--774[label="1;126pkt 126fpkt"];
115--1286[label="1;126pkt 126fpkt"];
115--3359[label="0.992063;125pkt 125fpkt"];
115--4435[label="0.992063;125pkt 125fpkt"];
115--5004[label="0.992063;125pkt 125fpkt"];
774--1286[label="1;126pkt 126fpkt"];
774--3359[label="0.992063;125pkt 125fpkt"];
774--4435[label="0.992063;125pkt 125fpkt"];
774--5004[label="0.992063;125pkt 125fpkt"];
1286--3359[label="0.992063;125pkt 125fpkt"];
1286--4435[label="0.992063;125pkt 125fpkt"];
1286--5004[label="0.992063;125pkt 125fpkt"];
3359--4435[label="1;155pkt 155fpkt"];
3359--5004[label="1;155pkt 155fpkt"];
4435--5004[label="1;155pkt 155fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="91.105.125.8" src_port="1028"/>
    </slice>
    <from sec="1041398277" usec="0"/>
    <to sec="1041398302" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="148.155.247.8"/>
    </slice>
    <from sec="1041397725" usec="0"/>
    <to sec="1041398086" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="217.61.107.11"/>
    </slice>
    <from sec="1041398052" usec="0"/>
    <to sec="1041398068" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="148.4.130.11"/>
    </slice>
    <from sec="1041397999" usec="0"/>
    <to sec="1041398005" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.10027,1.95018,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_731{
style=filled;
color=gray75;
2285[label="148.42.108.177;s;50pkt 50fpkt", shape=diamond, color=yellow];
2437[label="88.212.112.165;d;51pkt 51fpkt", shape=diamond, color=yellow];
2697[label="88.212.112.154;d;40pkt 40fpkt", shape=diamond, color=yellow];
3374[label="144.52.151.11;5pkt 5fpkt", shape=pentagon, color=darkviolet];
3851[label="148.4.130.116;7pkt 7fpkt", shape=pentagon, color=darkviolet];
3872[label="202.145.207.122;21pkt 21fpkt", shape=pentagon, color=darkviolet];
3918[label="202.159.250.130;79pkt 79fpkt", shape=pentagon, color=darkviolet];
4372[label="203.59.16.245;28pkt 28fpkt", shape=pentagon, color=darkviolet];
4692[label="148.4.130.116;7pkt 7fpkt", shape=invtriangle, color=brown];
4730[label="202.159.250.130;80pkt 80fpkt", shape=invtriangle, color=brown];
5139[label="148.4.130.116;7pkt 7fpkt", shape=invhouse, color=bisque];
stat731[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:80, *:*}[60.0733%]&lt;BR/&gt;{202.159.250.130:*, *:*}[29.304%]&lt;BR/&gt;{*:53, *:*}[21.978%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (25.4667%)&lt;BR/&gt; 53: (21.8667%)&lt;BR/&gt; 49152: (8.93333%)&lt;BR/&gt; 0: (3.2%)&lt;BR/&gt; 25: (1.33333%)&gt;];
}
2285--2697[label="0.025;1pkt 1fpkt"];
2437--2629[label="0.0196078;1pkt 1fpkt"];
2437--2766[label="0.0196078;1pkt 1fpkt"];
2437--2857[label="0.0784314;4pkt 4fpkt"];
2437--2962[label="0.0196078;1pkt 1fpkt"];
2437--3060[label="1;37pkt 37fpkt"];
2437--3374[label="0.2;1pkt 1fpkt"];
2437--3851[label="0.285714;2pkt 2fpkt"];
2437--3872[label="0.047619;1pkt 1fpkt"];
2437--3918[label="0.0196078;1pkt 1fpkt"];
2437--4222[label="0.0196078;1pkt 1fpkt"];
2437--4265[label="0.0196078;1pkt 1fpkt"];
2437--4372[label="0.0357143;1pkt 1fpkt"];
2437--4692[label="0.285714;2pkt 2fpkt"];
2437--4730[label="0.0196078;1pkt 1fpkt"];
2437--4922[label="0.0196078;1pkt 1fpkt"];
2437--5139[label="0.285714;2pkt 2fpkt"];
2437--5246[label="0.0196078;1pkt 1fpkt"];
2697--2766[label="0.025;1pkt 1fpkt"];
2697--2857[label="0.05;2pkt 2fpkt"];
2697--2962[label="0.05;2pkt 2fpkt"];
2697--3851[label="0.142857;1pkt 1fpkt"];
2697--3872[label="0.047619;1pkt 1fpkt"];
2697--4137[label="0.05;2pkt 2fpkt"];
2697--4222[label="0.05;2pkt 2fpkt"];
2697--4265[label="0.075;3pkt 3fpkt"];
2697--4692[label="0.142857;1pkt 1fpkt"];
2697--4751[label="0.030303;1pkt 1fpkt"];
2697--4922[label="0.075;3pkt 3fpkt"];
2697--5139[label="0.142857;1pkt 1fpkt"];
2697--5246[label="0.075;3pkt 3fpkt"];
3851--4692[label="1;7pkt 7fpkt"];
3851--5139[label="1;7pkt 7fpkt"];
3918--4730[label="1;79pkt 79fpkt"];
4692--5139[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter src_ip="202.159.250.130"/>
      <filter src_port="80"/>
      <filter src_port="53"/>
    </slice>
    <from sec="1041397216" usec="0"/>
    <to sec="1041398794" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="61.161.206.11"/>
    </slice>
    <from sec="1041397565" usec="0"/>
    <to sec="1041397587" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.234.200.13"/>
    </slice>
    <from sec="1041398540" usec="0"/>
    <to sec="1041398556" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="144.52.185.14"/>
    </slice>
    <from sec="1041397228" usec="0"/>
    <to sec="1041397674" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.142.218.14"/>
    </slice>
    <from sec="1041397235" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="216.204.1.15"/>
    </slice>
    <from sec="1041397889" usec="0"/>
    <to sec="1041398409" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="209.217.58.15"/>
    </slice>
    <from sec="1041397220" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.02037,1.88019,999,1 1 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_738{
style=filled;
color=gray75;
9[label="216.204.2.16s;1pkt 1fpkt", shape=rectangle, color=red];
707[label="216.204.2.16s;1pkt 1fpkt", shape=ellipse, color=green];
3400[label="216.204.2.16;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4458[label="216.204.2.16;1pkt 1fpkt", shape=invtriangle, color=brown];
5014[label="216.204.2.16;1pkt 1fpkt", shape=invhouse, color=bisque];
stat738[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.204.2.16:1050, 148.155.54.121:995}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1050: (50%)&lt;BR/&gt; 995: (50%)&gt;];
}
9--707[label="1;1pkt 1fpkt"];
9--3400[label="1;1pkt 1fpkt"];
9--4458[label="1;1pkt 1fpkt"];
9--5014[label="1;1pkt 1fpkt"];
707--3400[label="1;1pkt 1fpkt"];
707--4458[label="1;1pkt 1fpkt"];
707--5014[label="1;1pkt 1fpkt"];
3400--4458[label="1;1pkt 1fpkt"];
3400--5014[label="1;1pkt 1fpkt"];
4458--5014[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="148.155.54.121" dst_port="995" src_ip="216.204.2.16" src_port="1050"/>
    </slice>
    <from sec="1041398776" usec="0"/>
    <to sec="1041398802" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="144.52.23.17"/>
    </slice>
    <from sec="1041397329" usec="0"/>
    <to sec="1041398775" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.873736,1.91329,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_740{
style=filled;
color=gray75;
2112[label="136.234.119.18;s;171pkt 171fpkt", shape=diamond, color=yellow];
3415[label="136.234.119.18;200pkt 200fpkt", shape=pentagon, color=darkviolet];
4467[label="136.234.119.18;200pkt 200fpkt", shape=invtriangle, color=brown];
stat740[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.119.18:*, 211.161.32.5:80}[31.8408%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.7373%)&lt;BR/&gt; 1863: (0.262697%)&lt;BR/&gt; 1677: (0.262697%)&lt;BR/&gt; 1676: (0.262697%)&lt;BR/&gt; 1675: (0.262697%)&gt;];
}
2112--3415[label="0.994152;170pkt 170fpkt"];
2112--4467[label="0.994152;170pkt 170fpkt"];
3415--4467[label="1;200pkt 200fpkt"];
</description>
    <slice>
      <filter dst_ip="211.161.32.5" dst_port="80" src_ip="136.234.119.18"/>
    </slice>
    <from sec="1041397270" usec="0"/>
    <to sec="1041398457" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="88.113.235.19"/>
    </slice>
    <from sec="1041397792" usec="0"/>
    <to sec="1041397828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="148.155.85.20"/>
    </slice>
    <from sec="1041397685" usec="0"/>
    <to sec="1041398750" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="61.193.155.20"/>
    </slice>
    <from sec="1041397519" usec="0"/>
    <to sec="1041397555" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.565075,1.89171,002,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_744{
style=filled;
color=gray75;
139[label="91.27.23.21s;86pkt 86fpkt", shape=rectangle, color=red];
3431[label="91.27.23.21;262pkt 262fpkt", shape=pentagon, color=darkviolet];
stat744[shape=component, label=&lt;Rules:&lt;BR/&gt;{91.27.23.21:1028, *:137}[55.3435%]&lt;BR/&gt;{91.27.23.21:1029, *:137}[44.6565%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 1028: (33.1897%)&lt;BR/&gt; 1029: (16.8103%)&gt;];
}
139--3431[label="1;86pkt 86fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="91.27.23.21" src_port="1028"/>
      <filter dst_port="137" src_ip="91.27.23.21" src_port="1029"/>
    </slice>
    <from sec="1041397842" usec="0"/>
    <to sec="1041397893" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="63.21.80.21"/>
    </slice>
    <from sec="1041397695" usec="0"/>
    <to sec="1041397764" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="218.184.142.21"/>
    </slice>
    <from sec="1041397228" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="207.7.228.22"/>
    </slice>
    <from sec="1041397368" usec="0"/>
    <to sec="1041397835" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="90.93.122.23"/>
    </slice>
    <from sec="1041398284" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="213.168.25.24"/>
    </slice>
    <from sec="1041397219" usec="0"/>
    <to sec="1041398820" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.14.211.24"/>
    </slice>
    <from sec="1041397971" usec="0"/>
    <to sec="1041398013" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.565075,1.89171,002,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_751{
style=filled;
color=gray75;
149[label="169.200.228.24s;119pkt 119fpkt", shape=rectangle, color=red];
3451[label="169.200.228.24;118pkt 118fpkt", shape=pentagon, color=darkviolet];
stat751[shape=component, label=&lt;Rules:&lt;BR/&gt;{169.200.228.24:62849, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 62849: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
149--3451[label="1;118pkt 118fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="169.200.228.24" src_port="62849"/>
    </slice>
    <from sec="1041398335" usec="0"/>
    <to sec="1041398356" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.59.22.25"/>
    </slice>
    <from sec="1041397205" usec="0"/>
    <to sec="1041398819" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="93.56.34.25"/>
    </slice>
    <from sec="1041397215" usec="0"/>
    <to sec="1041398820" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.17.87.25"/>
    </slice>
    <from sec="1041397563" usec="0"/>
    <to sec="1041397590" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_755{
style=filled;
color=gray75;
152[label="211.57.173.25s;253pkt 253fpkt", shape=rectangle, color=red];
803[label="211.57.173.25s;253pkt 253fpkt", shape=ellipse, color=green];
1310[label="211.57.173.25s;253pkt 253fpkt", shape=triangle, color=blue];
3459[label="211.57.173.25;235pkt 235fpkt", shape=pentagon, color=darkviolet];
4484[label="211.57.173.25;234pkt 234fpkt", shape=invtriangle, color=brown];
stat755[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.57.173.25:1033, *:137}[89.0152%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 1033: (46.4577%)&lt;BR/&gt; 1031: (3.54235%)&gt;];
}
152--803[label="1;253pkt 253fpkt"];
152--1310[label="1;253pkt 253fpkt"];
152--3459[label="0.953191;224pkt 224fpkt"];
152--4484[label="0.952991;223pkt 223fpkt"];
803--1310[label="1;253pkt 253fpkt"];
803--3459[label="0.953191;224pkt 224fpkt"];
803--4484[label="0.952991;223pkt 223fpkt"];
1310--3459[label="0.953191;224pkt 224fpkt"];
1310--4484[label="0.952991;223pkt 223fpkt"];
3459--4484[label="1;234pkt 234fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="211.57.173.25" src_port="1033"/>
    </slice>
    <from sec="1041398631" usec="0"/>
    <to sec="1041398669" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.2.49.26"/>
    </slice>
    <from sec="1041398386" usec="0"/>
    <to sec="1041398723" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.10027,1.95018,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_757{
style=filled;
color=gray75;
2263[label="202.145.201.240;d;83pkt 83fpkt", shape=diamond, color=yellow];
2266[label="217.40.177.156;s;48pkt 48fpkt", shape=diamond, color=yellow];
4042[label="217.40.177.156;47pkt 47fpkt", shape=pentagon, color=darkviolet];
4798[label="217.40.177.156;47pkt 47fpkt", shape=invtriangle, color=brown];
5191[label="217.40.177.156;47pkt 47fpkt", shape=invhouse, color=bisque];
stat757[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.40.177.156:80, 202.145.201.240:*}[57.8313%]&lt;BR/&gt;{61.209.36.27:80, 202.145.201.240:*}[37.3494%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1559: (0.919118%)&lt;BR/&gt; 1558: (0.919118%)&lt;BR/&gt; 1557: (0.919118%)&lt;BR/&gt; 1556: (0.919118%)&gt;];
}
2263--2266[label="1;48pkt 48fpkt"];
2263--3464[label="0.588235;30pkt 30fpkt"];
2263--4042[label="1;47pkt 47fpkt"];
2263--4487[label="0.588235;30pkt 30fpkt"];
2263--4798[label="1;47pkt 47fpkt"];
2263--5031[label="0.596154;31pkt 31fpkt"];
2263--5191[label="1;47pkt 47fpkt"];
2266--4042[label="1;47pkt 47fpkt"];
2266--4798[label="1;47pkt 47fpkt"];
2266--5191[label="1;47pkt 47fpkt"];
4042--4798[label="1;47pkt 47fpkt"];
4042--5191[label="1;47pkt 47fpkt"];
4798--5191[label="1;47pkt 47fpkt"];
</description>
    <slice>
      <filter dst_ip="202.145.201.240" src_ip="217.40.177.156" src_port="80"/>
      <filter dst_ip="202.145.201.240" src_ip="61.209.36.27" src_port="80"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398705" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.145.24.28"/>
    </slice>
    <from sec="1041397251" usec="0"/>
    <to sec="1041398663" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.770694,1.8419,002,1 1 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_759{
style=filled;
color=gray75;
160[label="210.88.178.28s;161pkt 161fpkt", shape=rectangle, color=red];
808[label="210.88.178.28s;161pkt 161fpkt", shape=ellipse, color=green];
3470[label="210.88.178.28;240pkt 240fpkt", shape=pentagon, color=darkviolet];
4492[label="210.88.178.28;240pkt 240fpkt", shape=invtriangle, color=brown];
stat759[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.88.178.28:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
160--808[label="1;161pkt 161fpkt"];
160--3470[label="0.993789;160pkt 160fpkt"];
160--4492[label="0.993789;160pkt 160fpkt"];
808--3470[label="0.993789;160pkt 160fpkt"];
808--4492[label="0.993789;160pkt 160fpkt"];
3470--4492[label="1;240pkt 240fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="210.88.178.28" src_port="1027"/>
    </slice>
    <from sec="1041398029" usec="0"/>
    <to sec="1041398067" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.59.21.29"/>
    </slice>
    <from sec="1041397202" usec="0"/>
    <to sec="1041398807" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="70.167.60.29"/>
    </slice>
    <from sec="1041397204" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="217.22.147.29"/>
    </slice>
    <from sec="1041397545" usec="0"/>
    <to sec="1041397588" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="61.138.156.29"/>
    </slice>
    <from sec="1041397944" usec="0"/>
    <to sec="1041397975" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="90.222.49.32"/>
    </slice>
    <from sec="1041397439" usec="0"/>
    <to sec="1041398763" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="217.57.109.33"/>
    </slice>
    <from sec="1041397298" usec="0"/>
    <to sec="1041397326" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.969076,1.91301,503,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_766{
style=filled;
color=gray75;
226[label="61.244.8.67s;1pkt 1fpkt", shape=rectangle, color=red];
3493[label="202.145.206.33;33pkt 33fpkt", shape=pentagon, color=darkviolet];
4502[label="202.145.206.33;33pkt 33fpkt", shape=invtriangle, color=brown];
5040[label="202.145.206.33;33pkt 33fpkt", shape=invhouse, color=bisque];
stat766[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.145.206.33:*, 145.147.74.160:80}[48.4848%]&lt;BR/&gt;{202.145.206.33:*, 218.2.166.192:80}[30.303%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.5%)&lt;BR/&gt; 137: (3%)&lt;BR/&gt; 1204: (2%)&lt;BR/&gt; 1227: (1.5%)&lt;BR/&gt; 1226: (1.5%)&gt;];
}
226--2238[label="1;1pkt 1fpkt"];
226--3493[label="1;1pkt 1fpkt"];
226--4502[label="1;1pkt 1fpkt"];
226--5040[label="1;1pkt 1fpkt"];
3493--4502[label="1;33pkt 33fpkt"];
3493--5040[label="1;33pkt 33fpkt"];
4502--5040[label="1;33pkt 33fpkt"];
</description>
    <slice>
      <filter dst_ip="145.147.74.160" dst_port="80" src_ip="202.145.206.33"/>
      <filter dst_ip="218.2.166.192" dst_port="80" src_ip="202.145.206.33"/>
    </slice>
    <from sec="1041397643" usec="0"/>
    <to sec="1041398737" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="165.216.234.33"/>
    </slice>
    <from sec="1041397203" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.65.18.34"/>
    </slice>
    <from sec="1041397303" usec="0"/>
    <to sec="1041398746" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,501,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="88.186.149.34"/>
    </slice>
    <from sec="1041398213" usec="0"/>
    <to sec="1041398310" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.18933,1.9767,503,0 0 0 0 1 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_770{
style=filled;
color=gray75;
2831[label="197.90.54.66;d;43pkt 43fpkt", shape=hexagon, color=black];
3505[label="144.52.75.37;51pkt 51fpkt", shape=pentagon, color=darkviolet];
3827[label="144.52.72.113;20pkt 20fpkt", shape=pentagon, color=darkviolet];
4674[label="144.52.72.113;20pkt 20fpkt", shape=invtriangle, color=brown];
5130[label="144.52.72.113;21pkt 21fpkt", shape=invhouse, color=bisque];
stat770[shape=component, label=&lt;Rules:&lt;BR/&gt;{144.52.75.37:*, 197.90.54.66:80}[47.2222%]&lt;BR/&gt;{144.52.72.113:*, *:80}[29.1667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1043: (1.29032%)&lt;BR/&gt; 1042: (1.29032%)&lt;BR/&gt; 1041: (1.29032%)&lt;BR/&gt; 1040: (1.29032%)&gt;];
}
2831--3505[label="0.790698;34pkt 34fpkt"];
2831--3827[label="0.45;9pkt 9fpkt"];
2831--4674[label="0.45;9pkt 9fpkt"];
2831--5130[label="0.428571;9pkt 9fpkt"];
3827--4674[label="1;20pkt 20fpkt"];
3827--5130[label="1;20pkt 20fpkt"];
4674--5130[label="1;20pkt 20fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="144.52.72.113"/>
      <filter dst_ip="197.90.54.66" dst_port="80" src_ip="144.52.75.37"/>
    </slice>
    <from sec="1041397312" usec="0"/>
    <to sec="1041398201" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.87.216.37"/>
    </slice>
    <from sec="1041397625" usec="0"/>
    <to sec="1041398795" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_772{
style=filled;
color=gray75;
181[label="217.73.173.39s;204pkt 204fpkt", shape=rectangle, color=red];
827[label="217.73.173.39s;204pkt 204fpkt", shape=ellipse, color=green];
1327[label="217.73.173.39s;105pkt 105fpkt", shape=triangle, color=blue];
3519[label="217.73.173.39;216pkt 216fpkt", shape=pentagon, color=darkviolet];
4519[label="217.73.173.39;217pkt 217fpkt", shape=invtriangle, color=brown];
5050[label="217.73.173.39;217pkt 217fpkt", shape=invhouse, color=bisque];
stat772[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.73.173.39:1185, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1185: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
181--827[label="1;204pkt 204fpkt"];
181--1327[label="1;105pkt 105fpkt"];
181--3519[label="0.995098;203pkt 203fpkt"];
181--4519[label="1;204pkt 204fpkt"];
181--5050[label="1;204pkt 204fpkt"];
827--1327[label="1;105pkt 105fpkt"];
827--3519[label="0.995098;203pkt 203fpkt"];
827--4519[label="1;204pkt 204fpkt"];
827--5050[label="1;204pkt 204fpkt"];
1327--3519[label="1;105pkt 105fpkt"];
1327--4519[label="1;105pkt 105fpkt"];
1327--5050[label="1;105pkt 105fpkt"];
3519--4519[label="1;216pkt 216fpkt"];
3519--5050[label="1;216pkt 216fpkt"];
4519--5050[label="1;217pkt 217fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.73.173.39" src_port="1185"/>
    </slice>
    <from sec="1041398235" usec="0"/>
    <to sec="1041398268" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="165.208.51.40"/>
    </slice>
    <from sec="1041397201" usec="0"/>
    <to sec="1041397374" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.565075,1.89171,002,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_774{
style=filled;
color=gray75;
185[label="195.118.6.41s;143pkt 143fpkt", shape=rectangle, color=red];
3525[label="195.118.6.41;142pkt 142fpkt", shape=pentagon, color=darkviolet];
stat774[shape=component, label=&lt;Rules:&lt;BR/&gt;{195.118.6.41:34001, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 34001: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
185--3525[label="1;142pkt 142fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="195.118.6.41" src_port="34001"/>
    </slice>
    <from sec="1041397254" usec="0"/>
    <to sec="1041397282" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="70.96.138.42"/>
    </slice>
    <from sec="1041398289" usec="0"/>
    <to sec="1041398311" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.153.8.44"/>
    </slice>
    <from sec="1041397209" usec="0"/>
    <to sec="1041398713" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="91.81.62.44"/>
    </slice>
    <from sec="1041398319" usec="0"/>
    <to sec="1041398345" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="138.248.65.44"/>
    </slice>
    <from sec="1041397963" usec="0"/>
    <to sec="1041398019" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="161.142.199.44"/>
    </slice>
    <from sec="1041397202" usec="0"/>
    <to sec="1041397972" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.200.168.46"/>
    </slice>
    <from sec="1041397212" usec="0"/>
    <to sec="1041398815" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.820198,1.89686,002,0 0 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_781{
style=filled;
color=gray75;
1336[label="70.148.102.47s;109pkt 109fpkt", shape=triangle, color=blue];
3555[label="70.148.102.47;215pkt 215fpkt", shape=pentagon, color=darkviolet];
4535[label="70.148.102.47;214pkt 214fpkt", shape=invtriangle, color=brown];
stat781[shape=component, label=&lt;Rules:&lt;BR/&gt;{70.148.102.47:11972, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 11972: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
1336--3555[label="1;109pkt 109fpkt"];
1336--4535[label="0.990826;108pkt 108fpkt"];
3555--4535[label="1;214pkt 214fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="70.148.102.47" src_port="11972"/>
    </slice>
    <from sec="1041398589" usec="0"/>
    <to sec="1041398625" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="174.236.106.48"/>
    </slice>
    <from sec="1041398823" usec="0"/>
    <to sec="1041398824" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="219.171.157.48"/>
    </slice>
    <from sec="1041397204" usec="0"/>
    <to sec="1041398164" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.940809,1.83794,503,1 1 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_784{
style=filled;
color=gray75;
200[label="217.93.155.49s;1pkt 1fpkt", shape=rectangle, color=red];
842[label="217.93.155.49s;1pkt 1fpkt", shape=ellipse, color=green];
2216[label="218.159.207.49;s;125pkt 125fpkt", shape=diamond, color=yellow];
3563[label="218.159.207.49;136pkt 136fpkt", shape=pentagon, color=darkviolet];
4542[label="218.159.207.49;135pkt 135fpkt", shape=invtriangle, color=brown];
stat784[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.159.207.49:80, 202.159.192.34:*}[72.2628%]&lt;BR/&gt;{218.159.207.49:80, 202.159.192.25:*}[26.2774%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 50793: (0.628141%)&lt;BR/&gt; 53499: (0.376884%)&lt;BR/&gt; 53147: (0.376884%)&lt;BR/&gt; 52779: (0.376884%)&gt;];
}
200--842[label="1;1pkt 1fpkt"];
200--1661[label="1;1pkt 1fpkt"];
200--2216[label="1;1pkt 1fpkt"];
200--3563[label="1;1pkt 1fpkt"];
200--4542[label="1;1pkt 1fpkt"];
842--1661[label="1;1pkt 1fpkt"];
842--2216[label="1;1pkt 1fpkt"];
842--3563[label="1;1pkt 1fpkt"];
842--4542[label="1;1pkt 1fpkt"];
2216--2724[label="0.016;2pkt 2fpkt"];
2216--3563[label="0.992;124pkt 124fpkt"];
2216--4542[label="0.984;123pkt 123fpkt"];
3563--4542[label="1;135pkt 135fpkt"];
</description>
    <slice>
      <filter dst_ip="202.159.192.34" src_ip="218.159.207.49" src_port="80"/>
      <filter dst_ip="202.159.192.25" src_ip="218.159.207.49" src_port="80"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398821" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="61.250.173.50"/>
    </slice>
    <from sec="1041398096" usec="0"/>
    <to sec="1041398140" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.142.200.51"/>
    </slice>
    <from sec="1041397412" usec="0"/>
    <to sec="1041398779" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="90.72.0.52"/>
    </slice>
    <from sec="1041397562" usec="0"/>
    <to sec="1041398132" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.969076,1.91301,002,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_788{
style=filled;
color=gray75;
206[label="210.156.55.52s;61pkt 61fpkt", shape=rectangle, color=red];
3575[label="210.156.55.52;112pkt 112fpkt", shape=pentagon, color=darkviolet];
4549[label="210.156.55.52;113pkt 113fpkt", shape=invtriangle, color=brown];
5061[label="210.156.55.52;112pkt 112fpkt", shape=invhouse, color=bisque];
stat788[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.156.55.52:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
206--3575[label="0.983607;60pkt 60fpkt"];
206--4549[label="1;61pkt 61fpkt"];
206--5061[label="0.983607;60pkt 60fpkt"];
3575--4549[label="1;112pkt 112fpkt"];
3575--5061[label="1;112pkt 112fpkt"];
4549--5061[label="1;112pkt 112fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="210.156.55.52" src_port="1029"/>
    </slice>
    <from sec="1041397832" usec="0"/>
    <to sec="1041397860" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="90.200.192.52"/>
    </slice>
    <from sec="1041397655" usec="0"/>
    <to sec="1041398367" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="62.145.114.56"/>
    </slice>
    <from sec="1041397202" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="135.205.177.56"/>
    </slice>
    <from sec="1041398270" usec="0"/>
    <to sec="1041398311" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.56.208.56"/>
    </slice>
    <from sec="1041397434" usec="0"/>
    <to sec="1041397438" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="10.10.40.59"/>
    </slice>
    <from sec="1041397236" usec="0"/>
    <to sec="1041398822" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="90.222.49.60"/>
    </slice>
    <from sec="1041397219" usec="0"/>
    <to sec="1041398760" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.142.202.60"/>
    </slice>
    <from sec="1041397242" usec="0"/>
    <to sec="1041398804" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.55.55.61"/>
    </slice>
    <from sec="1041398618" usec="0"/>
    <to sec="1041398690" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.873736,1.91329,010,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_798{
style=filled;
color=gray75;
2670[label="61.255.93.63;s;345pkt 345fpkt", shape=diamond, color=yellow];
3609[label="61.255.93.63;344pkt 344fpkt", shape=pentagon, color=darkviolet];
4567[label="61.255.93.63;344pkt 344fpkt", shape=invtriangle, color=brown];
stat798[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.255.93.63:*, *:8080}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8080: (50%)&lt;BR/&gt; 24947: (0.145208%)&lt;BR/&gt; 24946: (0.145208%)&lt;BR/&gt; 24945: (0.145208%)&lt;BR/&gt; 24944: (0.145208%)&gt;];
}
2670--3609[label="1;344pkt 344fpkt"];
2670--4567[label="1;344pkt 344fpkt"];
3609--4567[label="1;344pkt 344fpkt"];
</description>
    <slice>
      <filter dst_port="8080" src_ip="61.255.93.63"/>
    </slice>
    <from sec="1041398496" usec="0"/>
    <to sec="1041398559" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.233.156.63"/>
    </slice>
    <from sec="1041397773" usec="0"/>
    <to sec="1041397841" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.701377,1.87539,002,1 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_800{
style=filled;
color=gray75;
223[label="70.181.211.63s;94pkt 94fpkt", shape=rectangle, color=red];
3611[label="70.181.211.63;100pkt 100fpkt", shape=pentagon, color=darkviolet];
4569[label="70.181.211.63;100pkt 100fpkt", shape=invtriangle, color=brown];
stat800[shape=component, label=&lt;Rules:&lt;BR/&gt;{70.181.211.63:1030, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1030: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
223--3611[label="0.989362;93pkt 93fpkt"];
223--4569[label="0.989362;93pkt 93fpkt"];
3611--4569[label="1;100pkt 100fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="70.181.211.63" src_port="1030"/>
    </slice>
    <from sec="1041397470" usec="0"/>
    <to sec="1041397487" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.768632,1.92929,020,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_801{
style=filled;
color=gray75;
2064[label="170.9.17.64;s;133pkt 133fpkt", shape=diamond, color=yellow];
3615[label="170.9.17.64;138pkt 138fpkt", shape=pentagon, color=darkviolet];
stat801[shape=component, label=&lt;Rules:&lt;BR/&gt;{170.9.17.64:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
2064--3615[label="0.992481;132pkt 132fpkt"];
</description>
    <slice>
      <filter src_ip="170.9.17.64"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="144.52.45.64"/>
    </slice>
    <from sec="1041398716" usec="0"/>
    <to sec="1041398736" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="218.93.64.64"/>
    </slice>
    <from sec="1041398542" usec="0"/>
    <to sec="1041398589" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="218.211.225.65"/>
    </slice>
    <from sec="1041397471" usec="0"/>
    <to sec="1041397686" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="61.244.8.67"/>
    </slice>
    <from sec="1041398270" usec="0"/>
    <to sec="1041398296" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.02037,1.88019,002,1 1 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_806{
style=filled;
color=gray75;
231[label="133.209.153.67s;71pkt 71fpkt", shape=rectangle, color=red];
866[label="133.209.153.67s;71pkt 71fpkt", shape=ellipse, color=green];
3635[label="133.209.153.67;107pkt 107fpkt", shape=pentagon, color=darkviolet];
4577[label="133.209.153.67;107pkt 107fpkt", shape=invtriangle, color=brown];
5080[label="133.209.153.67;106pkt 106fpkt", shape=invhouse, color=bisque];
stat806[shape=component, label=&lt;Rules:&lt;BR/&gt;{133.209.153.67:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
231--866[label="1;71pkt 71fpkt"];
231--3635[label="1;71pkt 71fpkt"];
231--4577[label="1;71pkt 71fpkt"];
231--5080[label="1;71pkt 71fpkt"];
866--3635[label="1;71pkt 71fpkt"];
866--4577[label="1;71pkt 71fpkt"];
866--5080[label="1;71pkt 71fpkt"];
3635--4577[label="1;107pkt 107fpkt"];
3635--5080[label="1;106pkt 106fpkt"];
4577--5080[label="1;106pkt 106fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="133.209.153.67" src_port="1025"/>
    </slice>
    <from sec="1041397569" usec="0"/>
    <to sec="1041397586" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.04191,1.81684,999,1 1 1 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_807{
style=filled;
color=gray75;
229[label="88.33.114.67s;511pkt 511fpkt", shape=rectangle, color=red];
864[label="88.33.114.67s;165pkt 165fpkt", shape=ellipse, color=green];
1356[label="88.33.114.67s;137pkt 137fpkt", shape=triangle, color=blue];
2184[label="202.159.194.67;s;420pkt 420fpkt", shape=diamond, color=yellow];
2651[label="209.107.20.180;d;8pkt 8fpkt", shape=diamond, color=yellow];
3633[label="88.33.114.67;223pkt 223fpkt", shape=pentagon, color=darkviolet];
3638[label="202.159.194.67;465pkt 465fpkt", shape=pentagon, color=darkviolet];
4579[label="202.159.194.67;464pkt 464fpkt", shape=invtriangle, color=brown];
stat807[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.159.194.67:1086, *:53}[59.7122%]&lt;BR/&gt;{88.33.114.67:*, *:137}[32.0863%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (33.9114%)&lt;BR/&gt; 1086: (33.6607%)&lt;BR/&gt; 137: (13.3305%)&lt;BR/&gt; 33295: (8.81738%)&lt;BR/&gt; 32793: (4.51316%)&gt;];
}
229--864[label="1;165pkt 165fpkt"];
229--1356[label="1;137pkt 137fpkt"];
229--2117[label="0.0833333;1pkt 1fpkt"];
229--2184[label="0.685714;288pkt 288fpkt"];
229--2416[label="0.0123457;1pkt 1fpkt"];
229--2651[label="0.125;1pkt 1fpkt"];
229--3274[label="0.0176125;9pkt 9fpkt"];
229--3278[label="0.0704501;36pkt 36fpkt"];
229--3282[label="0.0547945;28pkt 28fpkt"];
229--3288[label="0.0176125;9pkt 9fpkt"];
229--3293[label="0.0704501;36pkt 36fpkt"];
229--3296[label="0.0547945;28pkt 28fpkt"];
229--3297[label="0.0176125;9pkt 9fpkt"];
229--3633[label="1;223pkt 223fpkt"];
229--3638[label="0.619355;288pkt 288fpkt"];
229--4579[label="0.62069;288pkt 288fpkt"];
864--1356[label="1;137pkt 137fpkt"];
864--2184[label="0.333333;55pkt 55fpkt"];
864--2416[label="0.0123457;1pkt 1fpkt"];
864--2651[label="0.125;1pkt 1fpkt"];
864--3274[label="0.0484848;8pkt 8fpkt"];
864--3278[label="0.218182;36pkt 36fpkt"];
864--3282[label="0.169697;28pkt 28fpkt"];
864--3288[label="0.0484848;8pkt 8fpkt"];
864--3293[label="0.218182;36pkt 36fpkt"];
864--3296[label="0.169697;28pkt 28fpkt"];
864--3297[label="0.0484848;8pkt 8fpkt"];
864--3633[label="0.666667;110pkt 110fpkt"];
864--3638[label="0.333333;55pkt 55fpkt"];
864--4579[label="0.333333;55pkt 55fpkt"];
1356--2184[label="0.40146;55pkt 55fpkt"];
1356--2416[label="0.0123457;1pkt 1fpkt"];
1356--2651[label="0.125;1pkt 1fpkt"];
1356--3274[label="0.0583942;8pkt 8fpkt"];
1356--3278[label="0.262774;36pkt 36fpkt"];
1356--3282[label="0.20438;28pkt 28fpkt"];
1356--3288[label="0.0583942;8pkt 8fpkt"];
1356--3293[label="0.262774;36pkt 36fpkt"];
1356--3296[label="0.20438;28pkt 28fpkt"];
1356--3297[label="0.0583942;8pkt 8fpkt"];
1356--3633[label="0.59854;82pkt 82fpkt"];
1356--3638[label="0.40146;55pkt 55fpkt"];
1356--4579[label="0.40146;55pkt 55fpkt"];
2184--2416[label="0.0123457;1pkt 1fpkt"];
2184--2651[label="0.125;1pkt 1fpkt"];
2184--3274[label="0.0309524;13pkt 13fpkt"];
2184--3278[label="0.12381;52pkt 52fpkt"];
2184--3282[label="0.0833333;35pkt 35fpkt"];
2184--3288[label="0.0309524;13pkt 13fpkt"];
2184--3293[label="0.12381;52pkt 52fpkt"];
2184--3296[label="0.0833333;35pkt 35fpkt"];
2184--3297[label="0.0309524;13pkt 13fpkt"];
2184--3638[label="1;420pkt 420fpkt"];
2184--4579[label="0.997619;419pkt 419fpkt"];
2651--3279[label="0.25;2pkt 2fpkt"];
2651--3283[label="0.25;2pkt 2fpkt"];
2651--3284[label="0.25;2pkt 2fpkt"];
2651--3294[label="0.25;2pkt 2fpkt"];
2651--3638[label="0.125;1pkt 1fpkt"];
2651--3750[label="0.875;7pkt 7fpkt"];
2651--4579[label="0.125;1pkt 1fpkt"];
2651--4634[label="0.875;7pkt 7fpkt"];
3638--4579[label="1;464pkt 464fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="88.33.114.67"/>
      <filter dst_port="53" src_ip="202.159.194.67" src_port="1086"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.182.0.69"/>
    </slice>
    <from sec="1041398202" usec="0"/>
    <to sec="1041398211" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="195.16.27.69"/>
    </slice>
    <from sec="1041398457" usec="0"/>
    <to sec="1041398756" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.969076,1.91301,503,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_810{
style=filled;
color=gray75;
235[label="202.253.99.69s;1pkt 1fpkt", shape=rectangle, color=red];
3645[label="203.37.115.69;18pkt 18fpkt", shape=pentagon, color=darkviolet];
4582[label="203.37.115.69;18pkt 18fpkt", shape=invtriangle, color=brown];
5082[label="203.37.115.69;18pkt 18fpkt", shape=invhouse, color=bisque];
stat810[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.37.115.69:80, 202.159.194.95:*}[72.2222%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1573: (3.63636%)&lt;BR/&gt; 54705: (2.72727%)&lt;BR/&gt; 54416: (2.72727%)&lt;BR/&gt; 32475: (2.72727%)&gt;];
}
235--1621[label="1;1pkt 1fpkt"];
235--2724[label="1;1pkt 1fpkt"];
235--3645[label="1;1pkt 1fpkt"];
235--4582[label="1;1pkt 1fpkt"];
235--5082[label="1;1pkt 1fpkt"];
3645--4582[label="1;18pkt 18fpkt"];
3645--5082[label="1;18pkt 18fpkt"];
4582--5082[label="1;18pkt 18fpkt"];
</description>
    <slice>
      <filter dst_ip="202.159.194.95" src_ip="203.37.115.69" src_port="80"/>
    </slice>
    <from sec="1041397242" usec="0"/>
    <to sec="1041398821" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.989136,1.97543,503,0 0 1 0 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_811{
style=filled;
color=gray75;
1473[label="70.177.64.157s;1pkt 1fpkt", shape=triangle, color=blue];
2859[label="144.52.18.6;d;246pkt 246fpkt", shape=hexagon, color=black];
stat811[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.128.149.70:80, 144.52.18.6:*}[85.7724%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.7976%)&lt;BR/&gt; 1259: (0.404858%)&lt;BR/&gt; 1308: (0.202429%)&lt;BR/&gt; 1307: (0.202429%)&lt;BR/&gt; 1306: (0.202429%)&gt;];
}
1473--1882[label="1;1pkt 1fpkt"];
1473--2859[label="1;1pkt 1fpkt"];
2859--3378[label="0.0526316;1pkt 1fpkt"];
2859--3427[label="0.0625;1pkt 1fpkt"];
2859--3648[label="1;211pkt 211fpkt"];
2859--3763[label="0.0625;1pkt 1fpkt"];
2859--4474[label="0.0625;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="144.52.18.6" src_ip="208.128.149.70" src_port="80"/>
    </slice>
    <from sec="1041397272" usec="0"/>
    <to sec="1041397754" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.969076,1.91301,002,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_812{
style=filled;
color=gray75;
239[label="91.16.208.70s;233pkt 233fpkt", shape=rectangle, color=red];
3650[label="91.16.208.70;232pkt 232fpkt", shape=pentagon, color=darkviolet];
4585[label="91.16.208.70;233pkt 233fpkt", shape=invtriangle, color=brown];
5084[label="91.16.208.70;233pkt 233fpkt", shape=invhouse, color=bisque];
stat812[shape=component, label=&lt;Rules:&lt;BR/&gt;{91.16.208.70:62210, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 62210: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
239--3650[label="1;232pkt 232fpkt"];
239--4585[label="1;233pkt 233fpkt"];
239--5084[label="1;233pkt 233fpkt"];
3650--4585[label="1;232pkt 232fpkt"];
3650--5084[label="1;232pkt 232fpkt"];
4585--5084[label="1;233pkt 233fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="91.16.208.70" src_port="62210"/>
    </slice>
    <from sec="1041398671" usec="0"/>
    <to sec="1041398712" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.146.244.70"/>
    </slice>
    <from sec="1041397333" usec="0"/>
    <to sec="1041398477" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_814{
style=filled;
color=gray75;
4034[label="216.204.28.155;3pkt 3fpkt", shape=pentagon, color=darkviolet];
4794[label="216.204.28.155;3pkt 3fpkt", shape=invtriangle, color=brown];
stat814[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.204.28.155:1027, 144.52.42.104:110}[33.3333%]&lt;BR/&gt;{216.204.28.155:1060, 144.52.42.80:80}[33.3333%]&lt;BR/&gt;{216.204.28.155:1061, 144.52.42.80:80}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (33.3333%)&lt;BR/&gt; 1061: (16.6667%)&lt;BR/&gt; 1060: (16.6667%)&lt;BR/&gt; 1027: (16.6667%)&lt;BR/&gt; 110: (16.6667%)&gt;];
}
4034--4794[label="1;3pkt 3fpkt"];
4034--5189[label="1;2pkt 2fpkt"];
4794--5189[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="144.52.42.80" dst_port="80" src_ip="216.204.28.155" src_port="1061"/>
      <filter dst_ip="144.52.42.80" dst_port="80" src_ip="216.204.28.155" src_port="1060"/>
      <filter dst_ip="144.52.42.104" dst_port="110" src_ip="216.204.28.155" src_port="1027"/>
    </slice>
    <from sec="1041398375" usec="0"/>
    <to sec="1041398571" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.565075,1.89171,002,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_815{
style=filled;
color=gray75;
243[label="210.226.113.73s;163pkt 163fpkt", shape=rectangle, color=red];
3661[label="210.226.113.73;184pkt 184fpkt", shape=pentagon, color=darkviolet];
stat815[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.226.113.73:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
243--3661[label="1;163pkt 163fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="210.226.113.73" src_port="1029"/>
    </slice>
    <from sec="1041397838" usec="0"/>
    <to sec="1041397874" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="61.182.6.74"/>
    </slice>
    <from sec="1041397877" usec="0"/>
    <to sec="1041397911" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.84.96.74"/>
    </slice>
    <from sec="1041397964" usec="0"/>
    <to sec="1041398015" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.142.192.76"/>
    </slice>
    <from sec="1041398244" usec="0"/>
    <to sec="1041398815" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="168.125.55.77"/>
    </slice>
    <from sec="1041397768" usec="0"/>
    <to sec="1041397840" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.10027,1.95018,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_820{
style=filled;
color=gray75;
2485[label="88.212.112.6;d;25pkt 25fpkt", shape=diamond, color=yellow];
3680[label="168.125.149.77;7pkt 7fpkt", shape=pentagon, color=darkviolet];
4595[label="168.125.149.77;6pkt 6fpkt", shape=invtriangle, color=brown];
5090[label="168.125.149.77;7pkt 7fpkt", shape=invhouse, color=bisque];
stat820[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:80, 88.212.112.6:*}[61.2903%]&lt;BR/&gt;{168.125.149.77:80, *:*}[22.5806%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (43.3333%)&lt;BR/&gt; 53: (6.66667%)&lt;BR/&gt; 56796: (4.44444%)&lt;BR/&gt; 38838: (3.33333%)&lt;BR/&gt; 35519: (3.33333%)&gt;];
}
2485--2766[label="0.04;1pkt 1fpkt"];
2485--3201[label="1;25pkt 25fpkt"];
2485--3680[label="0.142857;1pkt 1fpkt"];
2485--3872[label="0.047619;1pkt 1fpkt"];
2485--4265[label="0.04;1pkt 1fpkt"];
2485--4318[label="0.12;3pkt 3fpkt"];
2485--4595[label="0.166667;1pkt 1fpkt"];
2485--4922[label="0.04;1pkt 1fpkt"];
2485--4949[label="0.12;3pkt 3fpkt"];
2485--5090[label="0.142857;1pkt 1fpkt"];
2485--5246[label="0.04;1pkt 1fpkt"];
2485--5265[label="0.12;3pkt 3fpkt"];
3680--4595[label="1;6pkt 6fpkt"];
3680--5090[label="1;7pkt 7fpkt"];
4595--5090[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter src_ip="168.125.149.77" src_port="80"/>
      <filter dst_ip="88.212.112.6" src_port="80"/>
    </slice>
    <from sec="1041397576" usec="0"/>
    <to sec="1041398747" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="217.50.2.80"/>
    </slice>
    <from sec="1041397603" usec="0"/>
    <to sec="1041398534" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="194.10.9.80"/>
    </slice>
    <from sec="1041397254" usec="0"/>
    <to sec="1041398760" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.770694,1.8419,002,1 1 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_824{
style=filled;
color=gray75;
259[label="61.219.40.82s;105pkt 105fpkt", shape=rectangle, color=red];
889[label="61.219.40.82s;52pkt 52fpkt", shape=ellipse, color=green];
3698[label="61.219.40.82;104pkt 104fpkt", shape=pentagon, color=darkviolet];
4605[label="61.219.40.82;104pkt 104fpkt", shape=invtriangle, color=brown];
stat824[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.219.40.82:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
259--889[label="1;52pkt 52fpkt"];
259--3698[label="1;104pkt 104fpkt"];
259--4605[label="1;104pkt 104fpkt"];
889--3698[label="1;52pkt 52fpkt"];
889--4605[label="1;52pkt 52fpkt"];
3698--4605[label="1;104pkt 104fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.219.40.82" src_port="1027"/>
    </slice>
    <from sec="1041398590" usec="0"/>
    <to sec="1041398608" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.80.113.82"/>
    </slice>
    <from sec="1041398583" usec="0"/>
    <to sec="1041398816" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.565075,1.89171,002,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_826{
style=filled;
color=gray75;
260[label="217.66.211.82s;129pkt 129fpkt", shape=rectangle, color=red];
3700[label="217.66.211.82;128pkt 128fpkt", shape=pentagon, color=darkviolet];
stat826[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.66.211.82:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
260--3700[label="1;128pkt 128fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.66.211.82" src_port="1025"/>
    </slice>
    <from sec="1041398786" usec="0"/>
    <to sec="1041398809" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.30601,1.97302,020,0 0 0 1 1 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_827{
style=filled;
color=gray75;
2520[label="148.155.48.150;d;26pkt 26fpkt", shape=diamond, color=yellow];
2524[label="203.59.21.83;d;29pkt 29fpkt", shape=diamond, color=yellow];
2577[label="172.142.201.140;d;24pkt 24fpkt", shape=diamond, color=yellow];
2578[label="203.59.20.151;d;24pkt 24fpkt", shape=diamond, color=yellow];
3129[label="203.59.21.83;d;29pkt 29fpkt", shape=hexagon, color=black];
3367[label="63.52.137.10;4pkt 4fpkt", shape=pentagon, color=darkviolet];
3711[label="204.46.164.84;4pkt 4fpkt", shape=pentagon, color=darkviolet];
3800[label="90.129.22.107;4pkt 4fpkt", shape=pentagon, color=darkviolet];
3951[label="205.162.18.137;5pkt 5fpkt", shape=pentagon, color=darkviolet];
4240[label="209.135.41.209;5pkt 5fpkt", shape=pentagon, color=darkviolet];
4281[label="218.159.225.218;4pkt 4fpkt", shape=pentagon, color=darkviolet];
4302[label="90.14.79.223;5pkt 5fpkt", shape=pentagon, color=darkviolet];
4440[label="63.52.137.10;4pkt 4fpkt", shape=invtriangle, color=brown];
5007[label="63.52.137.10;4pkt 4fpkt", shape=invhouse, color=bisque];
stat827[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 203.59.21.83:0}[26.8519%]&lt;BR/&gt;{*:0, 148.155.48.150:0}[23.1481%]&lt;BR/&gt;{*:0, 172.142.201.140:0}[22.2222%]&lt;BR/&gt;{*:0, 203.59.20.151:0}[22.2222%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.4152%)&lt;BR/&gt; 1890: (0.292398%)&lt;BR/&gt; 137: (0.292398%)&gt;];
}
2520--3280[label="0.0384615;1pkt 1fpkt"];
2520--3295[label="0.0384615;1pkt 1fpkt"];
2520--3367[label="0.25;1pkt 1fpkt"];
2520--3711[label="0.25;1pkt 1fpkt"];
2520--3800[label="0.25;1pkt 1fpkt"];
2520--3951[label="0.2;1pkt 1fpkt"];
2520--4240[label="0.2;1pkt 1fpkt"];
2520--4281[label="0.25;1pkt 1fpkt"];
2520--4302[label="0.2;1pkt 1fpkt"];
2520--4305[label="0.0384615;1pkt 1fpkt"];
2520--4440[label="0.25;1pkt 1fpkt"];
2520--5007[label="0.25;1pkt 1fpkt"];
2524--3129[label="1;29pkt 29fpkt"];
2524--3367[label="0.25;1pkt 1fpkt"];
2524--3837[label="0.0833333;1pkt 1fpkt"];
2524--3951[label="0.2;1pkt 1fpkt"];
2524--4159[label="0.047619;1pkt 1fpkt"];
2524--4240[label="0.2;1pkt 1fpkt"];
2524--4281[label="0.25;1pkt 1fpkt"];
2524--4302[label="0.2;1pkt 1fpkt"];
2524--4440[label="0.25;1pkt 1fpkt"];
2524--4682[label="0.0833333;1pkt 1fpkt"];
2524--5007[label="0.25;1pkt 1fpkt"];
2524--5213[label="0.047619;1pkt 1fpkt"];
2577--3367[label="0.25;1pkt 1fpkt"];
2577--3711[label="0.25;1pkt 1fpkt"];
2577--3800[label="0.25;1pkt 1fpkt"];
2577--3951[label="0.2;1pkt 1fpkt"];
2577--4240[label="0.2;1pkt 1fpkt"];
2577--4281[label="0.25;1pkt 1fpkt"];
2577--4302[label="0.2;1pkt 1fpkt"];
2577--4440[label="0.25;1pkt 1fpkt"];
2577--5007[label="0.25;1pkt 1fpkt"];
2578--3367[label="0.25;1pkt 1fpkt"];
2578--3711[label="0.25;1pkt 1fpkt"];
2578--3800[label="0.25;1pkt 1fpkt"];
2578--3951[label="0.2;1pkt 1fpkt"];
2578--4240[label="0.2;1pkt 1fpkt"];
2578--4281[label="0.25;1pkt 1fpkt"];
2578--4302[label="0.2;1pkt 1fpkt"];
2578--4440[label="0.25;1pkt 1fpkt"];
2578--5007[label="0.25;1pkt 1fpkt"];
3129--3367[label="0.25;1pkt 1fpkt"];
3129--3837[label="0.0833333;1pkt 1fpkt"];
3129--3951[label="0.2;1pkt 1fpkt"];
3129--4159[label="0.047619;1pkt 1fpkt"];
3129--4240[label="0.2;1pkt 1fpkt"];
3129--4281[label="0.25;1pkt 1fpkt"];
3129--4302[label="0.2;1pkt 1fpkt"];
3129--4440[label="0.25;1pkt 1fpkt"];
3129--4682[label="0.0833333;1pkt 1fpkt"];
3129--5007[label="0.25;1pkt 1fpkt"];
3129--5213[label="0.047619;1pkt 1fpkt"];
3367--4440[label="1;4pkt 4fpkt"];
3367--5007[label="1;4pkt 4fpkt"];
4440--5007[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="203.59.21.83"/>
      <filter dst_ip="148.155.48.150"/>
      <filter dst_ip="203.59.20.151"/>
      <filter dst_ip="172.142.201.140"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398820" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.701377,1.87539,002,1 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_828{
style=filled;
color=gray75;
621[label="195.163.9.85s;87pkt 87fpkt", shape=rectangle, color=red];
3713[label="195.163.9.85;100pkt 100fpkt", shape=pentagon, color=darkviolet];
4614[label="195.163.9.85;101pkt 101fpkt", shape=invtriangle, color=brown];
stat828[shape=component, label=&lt;Rules:&lt;BR/&gt;{195.163.9.85:*, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 35230: (0.520833%)&lt;BR/&gt; 35189: (0.520833%)&lt;BR/&gt; 35183: (0.520833%)&lt;BR/&gt; 35176: (0.520833%)&gt;];
}
621--3713[label="0.977011;85pkt 85fpkt"];
621--4614[label="0.988506;86pkt 86fpkt"];
3713--4614[label="1;100pkt 100fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="195.163.9.85"/>
    </slice>
    <from sec="1041398222" usec="0"/>
    <to sec="1041398239" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.649115,1.85851,002,1 1 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_829{
style=filled;
color=gray75;
266[label="88.233.15.85s;109pkt 109fpkt", shape=rectangle, color=red];
893[label="88.233.15.85s;65pkt 65fpkt", shape=ellipse, color=green];
3714[label="88.233.15.85;108pkt 108fpkt", shape=pentagon, color=darkviolet];
stat829[shape=component, label=&lt;Rules:&lt;BR/&gt;{88.233.15.85:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
266--893[label="1;65pkt 65fpkt"];
266--3714[label="1;108pkt 108fpkt"];
893--3714[label="1;65pkt 65fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="88.233.15.85" src_port="1027"/>
    </slice>
    <from sec="1041397272" usec="0"/>
    <to sec="1041397298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="90.8.197.87"/>
    </slice>
    <from sec="1041397495" usec="0"/>
    <to sec="1041397628" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="148.155.246.87"/>
    </slice>
    <from sec="1041397211" usec="0"/>
    <to sec="1041398819" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="165.253.2.88"/>
    </slice>
    <from sec="1041397209" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.12182,1.93656,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_833{
style=filled;
color=gray75;
2605[label="148.4.246.130;d;55pkt 55fpkt", shape=diamond, color=yellow];
3142[label="148.4.246.130;d;55pkt 55fpkt", shape=hexagon, color=black];
3726[label="61.202.117.88;21pkt 21fpkt", shape=pentagon, color=darkviolet];
4621[label="61.202.117.88;21pkt 21fpkt", shape=invtriangle, color=brown];
stat833[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.202.117.88:80, 148.4.246.130:*}[36.2069%]&lt;BR/&gt;{217.50.105.153:80, 148.4.246.130:*}[27.5862%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.0263%)&lt;BR/&gt; 1203: (1.31579%)&lt;BR/&gt; 1201: (1.31579%)&lt;BR/&gt; 1196: (1.31579%)&lt;BR/&gt; 1195: (1.31579%)&gt;];
}
2605--3142[label="1;55pkt 55fpkt"];
2605--3726[label="0.857143;18pkt 18fpkt"];
2605--4170[label="0.0181818;1pkt 1fpkt"];
2605--4621[label="0.857143;18pkt 18fpkt"];
2605--4809[label="0.111111;1pkt 1fpkt"];
2605--5194[label="0.111111;1pkt 1fpkt"];
3142--3726[label="0.857143;18pkt 18fpkt"];
3142--4170[label="0.0181818;1pkt 1fpkt"];
3142--4621[label="0.857143;18pkt 18fpkt"];
3142--4809[label="0.111111;1pkt 1fpkt"];
3142--5194[label="0.111111;1pkt 1fpkt"];
3726--4621[label="1;21pkt 21fpkt"];
</description>
    <slice>
      <filter dst_ip="148.4.246.130" src_ip="61.202.117.88" src_port="80"/>
      <filter dst_ip="148.4.246.130" src_ip="217.50.105.153" src_port="80"/>
    </slice>
    <from sec="1041398310" usec="0"/>
    <to sec="1041398774" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="89.16.244.90"/>
    </slice>
    <from sec="1041397304" usec="0"/>
    <to sec="1041398047" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,502,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="216.204.107.92"/>
    </slice>
    <from sec="1041397242" usec="0"/>
    <to sec="1041397604" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.649115,1.85851,002,1 1 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_836{
style=filled;
color=gray75;
282[label="217.19.117.94s;252pkt 252fpkt", shape=rectangle, color=red];
907[label="217.19.117.94s;75pkt 75fpkt", shape=ellipse, color=green];
3747[label="217.19.117.94;251pkt 251fpkt", shape=pentagon, color=darkviolet];
stat836[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.19.117.94:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
282--907[label="1;75pkt 75fpkt"];
282--3747[label="1;251pkt 251fpkt"];
907--3747[label="0.986667;74pkt 74fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.19.117.94" src_port="1025"/>
    </slice>
    <from sec="1041397283" usec="0"/>
    <to sec="1041397326" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_837{
style=filled;
color=gray75;
285[label="61.241.193.95s;184pkt 184fpkt", shape=rectangle, color=red];
910[label="61.241.193.95s;184pkt 184fpkt", shape=ellipse, color=green];
1384[label="61.241.193.95s;184pkt 184fpkt", shape=triangle, color=blue];
3749[label="61.241.193.95;230pkt 230fpkt", shape=pentagon, color=darkviolet];
4633[label="61.241.193.95;230pkt 230fpkt", shape=invtriangle, color=brown];
5112[label="61.241.193.95;230pkt 230fpkt", shape=invhouse, color=bisque];
stat837[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.241.193.95:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
285--910[label="1;184pkt 184fpkt"];
285--1384[label="1;184pkt 184fpkt"];
285--3749[label="0.994565;183pkt 183fpkt"];
285--4633[label="0.994565;183pkt 183fpkt"];
285--5112[label="0.994565;183pkt 183fpkt"];
910--1384[label="1;184pkt 184fpkt"];
910--3749[label="0.994565;183pkt 183fpkt"];
910--4633[label="0.994565;183pkt 183fpkt"];
910--5112[label="0.994565;183pkt 183fpkt"];
1384--3749[label="0.994565;183pkt 183fpkt"];
1384--4633[label="0.994565;183pkt 183fpkt"];
1384--5112[label="0.994565;183pkt 183fpkt"];
3749--4633[label="1;230pkt 230fpkt"];
3749--5112[label="1;230pkt 230fpkt"];
4633--5112[label="1;230pkt 230fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.241.193.95" src_port="1028"/>
    </slice>
    <from sec="1041397784" usec="0"/>
    <to sec="1041397824" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="90.3.82.96"/>
    </slice>
    <from sec="1041397211" usec="0"/>
    <to sec="1041398812" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.12182,1.93656,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_840{
style=filled;
color=gray75;
2126[label="148.155.42.21;d;28pkt 28fpkt", shape=diamond, color=yellow];
2870[label="148.155.42.21;d;16pkt 16fpkt", shape=hexagon, color=black];
3501[label="206.201.12.35;2pkt 2fpkt", shape=pentagon, color=darkviolet];
3757[label="89.97.129.97;26pkt 26fpkt", shape=pentagon, color=darkviolet];
4638[label="89.97.129.97;27pkt 27fpkt", shape=invtriangle, color=brown];
stat840[shape=component, label=&lt;Rules:&lt;BR/&gt;{89.97.129.97:*, 148.155.42.21:80}[93.1034%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4138: (2.0202%)&lt;BR/&gt; 3988: (2.0202%)&lt;BR/&gt; 3580: (2.0202%)&lt;BR/&gt; 3488: (2.0202%)&gt;];
}
2126--2870[label="1;16pkt 16fpkt"];
2126--3275[label="0.0714286;2pkt 2fpkt"];
2126--3279[label="0.0357143;1pkt 1fpkt"];
2126--3283[label="0.0357143;1pkt 1fpkt"];
2126--3284[label="0.0357143;1pkt 1fpkt"];
2126--3289[label="0.0714286;2pkt 2fpkt"];
2126--3294[label="0.0357143;1pkt 1fpkt"];
2126--3298[label="0.0714286;2pkt 2fpkt"];
2126--3501[label="1;2pkt 2fpkt"];
2126--3757[label="0.961538;25pkt 25fpkt"];
2126--4638[label="0.962963;26pkt 26fpkt"];
2870--3275[label="0.125;2pkt 2fpkt"];
2870--3289[label="0.125;2pkt 2fpkt"];
2870--3298[label="0.125;2pkt 2fpkt"];
2870--3501[label="1;2pkt 2fpkt"];
2870--3757[label="0.8125;13pkt 13fpkt"];
2870--4638[label="0.875;14pkt 14fpkt"];
3757--4638[label="1;26pkt 26fpkt"];
</description>
    <slice>
      <filter dst_ip="148.155.42.21" dst_port="80" src_ip="89.97.129.97"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398802" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.768632,1.92929,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_841{
style=filled;
color=gray75;
2681[label="172.142.193.97;s;4pkt 4fpkt", shape=diamond, color=yellow];
2682[label="210.89.0.215;d;10pkt 10fpkt", shape=diamond, color=yellow];
3759[label="172.142.193.97;9pkt 9fpkt", shape=pentagon, color=darkviolet];
stat841[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.142.193.97:80, 210.89.0.215:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1230: (6.52174%)&lt;BR/&gt; 1228: (6.52174%)&lt;BR/&gt; 1226: (6.52174%)&lt;BR/&gt; 1235: (4.34783%)&gt;];
}
2681--2682[label="1;4pkt 4fpkt"];
2681--3759[label="0.75;3pkt 3fpkt"];
2682--3759[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="210.89.0.215" src_ip="172.142.193.97" src_port="80"/>
    </slice>
    <from sec="1041398615" usec="0"/>
    <to sec="1041398728" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.204.249.97"/>
    </slice>
    <from sec="1041397236" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757634,1.96858,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_843{
style=filled;
color=gray75;
2021[label="208.128.149.70;s;211pkt 211fpkt", shape=diamond, color=yellow];
stat843[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.128.149.70:80, 144.52.18.6:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1308: (0.236967%)&lt;BR/&gt; 1307: (0.236967%)&lt;BR/&gt; 1306: (0.236967%)&lt;BR/&gt; 1305: (0.236967%)&gt;];
}
2021--2859[label="1;211pkt 211fpkt"];
2021--3648[label="1;211pkt 211fpkt"];
</description>
    <slice>
      <filter dst_ip="144.52.18.6" src_ip="208.128.149.70" src_port="80"/>
    </slice>
    <from sec="1041397272" usec="0"/>
    <to sec="1041397754" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.969076,1.91301,002,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_844{
style=filled;
color=gray75;
291[label="93.229.65.98s;109pkt 109fpkt", shape=rectangle, color=red];
3765[label="93.229.65.98;109pkt 109fpkt", shape=pentagon, color=darkviolet];
4641[label="93.229.65.98;109pkt 109fpkt", shape=invtriangle, color=brown];
5114[label="93.229.65.98;109pkt 109fpkt", shape=invhouse, color=bisque];
stat844[shape=component, label=&lt;Rules:&lt;BR/&gt;{93.229.65.98:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
291--3285[label="1;109pkt 109fpkt"];
291--3765[label="1;109pkt 109fpkt"];
291--4641[label="1;109pkt 109fpkt"];
291--5114[label="1;109pkt 109fpkt"];
3765--4641[label="1;109pkt 109fpkt"];
3765--5114[label="1;109pkt 109fpkt"];
4641--5114[label="1;109pkt 109fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="93.229.65.98" src_port="1028"/>
    </slice>
    <from sec="1041398753" usec="0"/>
    <to sec="1041398782" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.22.202.100"/>
    </slice>
    <from sec="1041397206" usec="0"/>
    <to sec="1041398810" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.142.204.100"/>
    </slice>
    <from sec="1041397202" usec="0"/>
    <to sec="1041398811" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="144.52.42.104"/>
    </slice>
    <from sec="1041397277" usec="0"/>
    <to sec="1041398773" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="61.240.190.109"/>
    </slice>
    <from sec="1041397679" usec="0"/>
    <to sec="1041397698" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.969076,1.91301,002,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_849{
style=filled;
color=gray75;
316[label="217.88.16.110s;60pkt 60fpkt", shape=rectangle, color=red];
3812[label="217.88.16.110;120pkt 120fpkt", shape=pentagon, color=darkviolet];
4667[label="217.88.16.110;119pkt 119fpkt", shape=invtriangle, color=brown];
5125[label="217.88.16.110;119pkt 119fpkt", shape=invhouse, color=bisque];
stat849[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.88.16.110:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
316--3812[label="1;60pkt 60fpkt"];
316--4667[label="1;60pkt 60fpkt"];
316--5125[label="1;60pkt 60fpkt"];
3812--4667[label="1;119pkt 119fpkt"];
3812--5125[label="1;119pkt 119fpkt"];
4667--5125[label="1;119pkt 119fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.88.16.110" src_port="1028"/>
    </slice>
    <from sec="1041397795" usec="0"/>
    <to sec="1041397821" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="148.4.128.110"/>
    </slice>
    <from sec="1041397209" usec="0"/>
    <to sec="1041398820" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="88.248.40.112"/>
    </slice>
    <from sec="1041397826" usec="0"/>
    <to sec="1041398283" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.142.192.112"/>
    </slice>
    <from sec="1041397375" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_853{
style=filled;
color=gray75;
3841[label="218.211.226.114;29pkt 29fpkt", shape=pentagon, color=darkviolet];
4685[label="218.211.226.114;29pkt 29fpkt", shape=invtriangle, color=brown];
stat853[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.211.226.114:80, 148.155.54.129:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 39612: (1.72414%)&lt;BR/&gt; 39611: (1.72414%)&lt;BR/&gt; 39610: (1.72414%)&lt;BR/&gt; 39609: (1.72414%)&gt;];
}
3841--4685[label="1;29pkt 29fpkt"];
3841--5136[label="1;29pkt 29fpkt"];
4685--5136[label="1;29pkt 29fpkt"];
</description>
    <slice>
      <filter dst_ip="148.155.54.129" src_ip="218.211.226.114" src_port="80"/>
    </slice>
    <from sec="1041397245" usec="0"/>
    <to sec="1041398801" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.30601,1.97302,503,0 0 0 1 1 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_854{
style=filled;
color=gray75;
1771[label="136.234.119.18;d;85pkt 85fpkt", shape=diamond, color=yellow];
1957[label="210.165.201.113;s;12pkt 12fpkt", shape=diamond, color=yellow];
2771[label="136.234.119.18;d;70pkt 70fpkt", shape=hexagon, color=black];
3833[label="210.165.201.113;11pkt 11fpkt", shape=pentagon, color=darkviolet];
3852[label="210.165.201.116;64pkt 64fpkt", shape=pentagon, color=darkviolet];
4016[label="61.0.239.150;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4679[label="210.165.201.113;11pkt 11fpkt", shape=invtriangle, color=brown];
4693[label="210.165.201.116;63pkt 63fpkt", shape=invtriangle, color=brown];
4782[label="61.0.239.150;1pkt 1fpkt", shape=invtriangle, color=brown];
5133[label="210.165.201.113;12pkt 12fpkt", shape=invhouse, color=bisque];
5140[label="210.165.201.116;64pkt 64fpkt", shape=invhouse, color=bisque];
5182[label="61.0.239.150;1pkt 1fpkt", shape=invhouse, color=bisque];
stat854[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.165.201.116:80, 136.234.119.18:*}[75.2941%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.8734%)&lt;BR/&gt; 1470: (0.759494%)&lt;BR/&gt; 1467: (0.759494%)&lt;BR/&gt; 1466: (0.759494%)&lt;BR/&gt; 1458: (0.759494%)&gt;];
}
1771--1957[label="1;12pkt 12fpkt"];
1771--2771[label="1;70pkt 70fpkt"];
1771--3833[label="1;11pkt 11fpkt"];
1771--3852[label="1;64pkt 64fpkt"];
1771--4016[label="1;1pkt 1fpkt"];
1771--4679[label="1;11pkt 11fpkt"];
1771--4693[label="1;63pkt 63fpkt"];
1771--4782[label="1;1pkt 1fpkt"];
1771--5133[label="1;12pkt 12fpkt"];
1771--5140[label="1;64pkt 64fpkt"];
1771--5182[label="1;1pkt 1fpkt"];
1957--2771[label="1;12pkt 12fpkt"];
1957--3833[label="1;11pkt 11fpkt"];
1957--4679[label="1;11pkt 11fpkt"];
1957--5133[label="1;12pkt 12fpkt"];
2771--3833[label="1;11pkt 11fpkt"];
2771--3852[label="0.890625;57pkt 57fpkt"];
2771--4679[label="1;11pkt 11fpkt"];
2771--4693[label="0.888889;56pkt 56fpkt"];
2771--5133[label="1;12pkt 12fpkt"];
2771--5140[label="0.890625;57pkt 57fpkt"];
3833--4679[label="1;11pkt 11fpkt"];
3833--5133[label="1;11pkt 11fpkt"];
3852--4693[label="1;63pkt 63fpkt"];
3852--5140[label="1;64pkt 64fpkt"];
4016--4782[label="1;1pkt 1fpkt"];
4016--5182[label="1;1pkt 1fpkt"];
4679--5133[label="1;11pkt 11fpkt"];
4693--5140[label="1;63pkt 63fpkt"];
4782--5182[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="136.234.119.18" src_ip="210.165.201.116" src_port="80"/>
    </slice>
    <from sec="1041397270" usec="0"/>
    <to sec="1041397882" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="90.198.217.113"/>
    </slice>
    <from sec="1041398465" usec="0"/>
    <to sec="1041398471" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.159.238.113"/>
    </slice>
    <from sec="1041397217" usec="0"/>
    <to sec="1041398820" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="61.205.0.115"/>
    </slice>
    <from sec="1041398800" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="192.163.103.115"/>
    </slice>
    <from sec="1041397656" usec="0"/>
    <to sec="1041397732" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.02037,1.88019,002,1 1 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_859{
style=filled;
color=gray75;
333[label="88.120.232.118s;117pkt 117fpkt", shape=rectangle, color=red];
952[label="88.120.232.118s;89pkt 89fpkt", shape=ellipse, color=green];
3858[label="88.120.232.118;116pkt 116fpkt", shape=pentagon, color=darkviolet];
4696[label="88.120.232.118;117pkt 117fpkt", shape=invtriangle, color=brown];
5144[label="88.120.232.118;117pkt 117fpkt", shape=invhouse, color=bisque];
stat859[shape=component, label=&lt;Rules:&lt;BR/&gt;{88.120.232.118:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
333--952[label="1;89pkt 89fpkt"];
333--3858[label="1;116pkt 116fpkt"];
333--4696[label="1;117pkt 117fpkt"];
333--5144[label="1;117pkt 117fpkt"];
952--3858[label="0.988764;88pkt 88fpkt"];
952--4696[label="1;89pkt 89fpkt"];
952--5144[label="1;89pkt 89fpkt"];
3858--4696[label="1;116pkt 116fpkt"];
3858--5144[label="1;116pkt 116fpkt"];
4696--5144[label="1;117pkt 117fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="88.120.232.118" src_port="1029"/>
    </slice>
    <from sec="1041398599" usec="0"/>
    <to sec="1041398632" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.707182,1.913,002,0 0 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_860{
style=filled;
color=gray75;
1421[label="133.209.83.119s;226pkt 226fpkt", shape=triangle, color=blue];
3861[label="133.209.83.119;264pkt 264fpkt", shape=pentagon, color=darkviolet];
stat860[shape=component, label=&lt;Rules:&lt;BR/&gt;{133.209.83.119:1033, *:137}[90.5303%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 1033: (47.449%)&lt;BR/&gt; 1032: (2.55102%)&gt;];
}
1421--3861[label="1;226pkt 226fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="133.209.83.119" src_port="1033"/>
    </slice>
    <from sec="1041397587" usec="0"/>
    <to sec="1041398384" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.142.242.119"/>
    </slice>
    <from sec="1041397676" usec="0"/>
    <to sec="1041398760" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.80.24.120"/>
    </slice>
    <from sec="1041397652" usec="0"/>
    <to sec="1041398344" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="89.16.249.122"/>
    </slice>
    <from sec="1041398823" usec="0"/>
    <to sec="1041398824" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="192.163.103.123"/>
    </slice>
    <from sec="1041397222" usec="0"/>
    <to sec="1041397247" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.02037,1.88019,002,1 1 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_865{
style=filled;
color=gray75;
345[label="216.241.146.125s;106pkt 106fpkt", shape=rectangle, color=red];
963[label="216.241.146.125s;106pkt 106fpkt", shape=ellipse, color=green];
3885[label="216.241.146.125;105pkt 105fpkt", shape=pentagon, color=darkviolet];
4711[label="216.241.146.125;106pkt 106fpkt", shape=invtriangle, color=brown];
5152[label="216.241.146.125;106pkt 106fpkt", shape=invhouse, color=bisque];
stat865[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.241.146.125:1030, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1030: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
345--963[label="1;106pkt 106fpkt"];
345--3885[label="1;105pkt 105fpkt"];
345--4711[label="1;106pkt 106fpkt"];
345--5152[label="1;106pkt 106fpkt"];
963--3885[label="1;105pkt 105fpkt"];
963--4711[label="1;106pkt 106fpkt"];
963--5152[label="1;106pkt 106fpkt"];
3885--4711[label="1;105pkt 105fpkt"];
3885--5152[label="1;105pkt 105fpkt"];
4711--5152[label="1;106pkt 106fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="216.241.146.125" src_port="1030"/>
    </slice>
    <from sec="1041398282" usec="0"/>
    <to sec="1041398300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_866{
style=filled;
color=gray75;
347[label="216.241.161.126s;256pkt 256fpkt", shape=rectangle, color=red];
965[label="216.241.161.126s;256pkt 256fpkt", shape=ellipse, color=green];
1429[label="216.241.161.126s;393pkt 393fpkt", shape=triangle, color=blue];
3889[label="216.241.161.126;255pkt 255fpkt", shape=pentagon, color=darkviolet];
4714[label="216.241.161.126;256pkt 256fpkt", shape=invtriangle, color=brown];
5153[label="216.241.161.126;255pkt 255fpkt", shape=invhouse, color=bisque];
stat866[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.241.161.126:1030, *:137}[65.1399%]&lt;BR/&gt;{210.228.69.38:1026, *:137}[34.8601%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 1030: (45.9007%)&lt;BR/&gt; 1026: (4.09934%)&gt;];
}
347--965[label="1;256pkt 256fpkt"];
347--1429[label="1;256pkt 256fpkt"];
347--3889[label="1;255pkt 255fpkt"];
347--4714[label="1;256pkt 256fpkt"];
347--5153[label="1;255pkt 255fpkt"];
965--1429[label="1;256pkt 256fpkt"];
965--3889[label="1;255pkt 255fpkt"];
965--4714[label="1;256pkt 256fpkt"];
965--5153[label="1;255pkt 255fpkt"];
1429--3511[label="0.736559;137pkt 137fpkt"];
1429--3889[label="1;255pkt 255fpkt"];
1429--4714[label="1;256pkt 256fpkt"];
1429--5153[label="1;255pkt 255fpkt"];
3889--4714[label="1;255pkt 255fpkt"];
3889--5153[label="1;255pkt 255fpkt"];
4714--5153[label="1;255pkt 255fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="216.241.161.126" src_port="1030"/>
      <filter dst_port="137" src_ip="210.228.69.38" src_port="1026"/>
    </slice>
    <from sec="1041397855" usec="0"/>
    <to sec="1041397880" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.768632,1.92929,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_867{
style=filled;
color=gray75;
2403[label="203.37.115.127;s;1pkt 1fpkt", shape=diamond, color=yellow];
3893[label="203.37.115.127;5pkt 5fpkt", shape=pentagon, color=darkviolet];
stat867[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.37.115.127:80, 202.159.192.25:3708}[20%]&lt;BR/&gt;{203.37.115.127:80, 202.159.192.25:3875}[20%]&lt;BR/&gt;{203.37.115.127:80, 202.159.192.25:3917}[20%]&lt;BR/&gt;{203.37.115.127:80, 202.159.192.25:3978}[20%]&lt;BR/&gt;{203.37.115.127:80, 202.159.192.25:5651}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 5651: (16.6667%)&lt;BR/&gt; 3978: (8.33333%)&lt;BR/&gt; 3917: (8.33333%)&lt;BR/&gt; 3875: (8.33333%)&gt;];
}
2403--3893[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="202.159.192.25" dst_port="5651" src_ip="203.37.115.127" src_port="80"/>
      <filter dst_ip="202.159.192.25" dst_port="3978" src_ip="203.37.115.127" src_port="80"/>
      <filter dst_ip="202.159.192.25" dst_port="3917" src_ip="203.37.115.127" src_port="80"/>
      <filter dst_ip="202.159.192.25" dst_port="3875" src_ip="203.37.115.127" src_port="80"/>
      <filter dst_ip="202.159.192.25" dst_port="3708" src_ip="203.37.115.127" src_port="80"/>
    </slice>
    <from sec="1041397840" usec="0"/>
    <to sec="1041398723" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="218.31.108.129"/>
    </slice>
    <from sec="1041398258" usec="0"/>
    <to sec="1041398304" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="62.122.10.131"/>
    </slice>
    <from sec="1041398701" usec="0"/>
    <to sec="1041398747" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.565075,1.89171,002,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_870{
style=filled;
color=gray75;
361[label="203.99.38.131s;74pkt 74fpkt", shape=rectangle, color=red];
3920[label="203.99.38.131;183pkt 183fpkt", shape=pentagon, color=darkviolet];
stat870[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.99.38.131:1084, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1084: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
361--3920[label="1;74pkt 74fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="203.99.38.131" src_port="1084"/>
    </slice>
    <from sec="1041397732" usec="0"/>
    <to sec="1041397768" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.10917,1.9092,002,1 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_871{
style=filled;
color=gray75;
363[label="61.88.82.131s;845pkt 845fpkt", shape=rectangle, color=red];
2120[label="61.88.82.131;s;621pkt 621fpkt", shape=diamond, color=yellow];
3922[label="61.88.82.131;844pkt 844fpkt", shape=pentagon, color=darkviolet];
4734[label="61.88.82.131;844pkt 844fpkt", shape=invtriangle, color=brown];
5161[label="61.88.82.131;845pkt 845fpkt", shape=invhouse, color=bisque];
stat871[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.88.82.131:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
363--2120[label="1;621pkt 621fpkt"];
363--3922[label="1;844pkt 844fpkt"];
363--4734[label="1;844pkt 844fpkt"];
363--5161[label="1;845pkt 845fpkt"];
2120--3922[label="1;621pkt 621fpkt"];
2120--4734[label="1;621pkt 621fpkt"];
2120--5161[label="1;621pkt 621fpkt"];
3922--4734[label="1;844pkt 844fpkt"];
3922--5161[label="1;844pkt 844fpkt"];
4734--5161[label="1;844pkt 844fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.88.82.131" src_port="1027"/>
    </slice>
    <from sec="1041397530" usec="0"/>
    <to sec="1041398345" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="218.22.183.131"/>
    </slice>
    <from sec="1041397209" usec="0"/>
    <to sec="1041398820" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.969076,1.91301,002,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_873{
style=filled;
color=gray75;
366[label="217.70.12.132s;179pkt 179fpkt", shape=rectangle, color=red];
3924[label="217.70.12.132;191pkt 191fpkt", shape=pentagon, color=darkviolet];
4736[label="217.70.12.132;191pkt 191fpkt", shape=invtriangle, color=brown];
5162[label="217.70.12.132;191pkt 191fpkt", shape=invhouse, color=bisque];
stat873[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.70.12.132:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
366--3924[label="1;179pkt 179fpkt"];
366--4736[label="1;179pkt 179fpkt"];
366--5162[label="1;179pkt 179fpkt"];
3924--4736[label="1;191pkt 191fpkt"];
3924--5162[label="1;191pkt 191fpkt"];
4736--5162[label="1;191pkt 191fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.70.12.132" src_port="1025"/>
    </slice>
    <from sec="1041398406" usec="0"/>
    <to sec="1041398435" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="148.155.56.132"/>
    </slice>
    <from sec="1041398823" usec="0"/>
    <to sec="1041398824" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.701377,1.87539,002,1 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_875{
style=filled;
color=gray75;
626[label="61.198.78.133s;93pkt 93fpkt", shape=rectangle, color=red];
3930[label="61.198.78.133;125pkt 125fpkt", shape=pentagon, color=darkviolet];
4739[label="61.198.78.133;124pkt 124fpkt", shape=invtriangle, color=brown];
stat875[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.198.78.133:*, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 35216: (0.438596%)&lt;BR/&gt; 34937: (0.438596%)&lt;BR/&gt; 34910: (0.438596%)&lt;BR/&gt; 34890: (0.438596%)&gt;];
}
626--3930[label="1;93pkt 93fpkt"];
626--4739[label="0.989247;92pkt 92fpkt"];
3930--4739[label="1;124pkt 124fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.198.78.133"/>
    </slice>
    <from sec="1041397428" usec="0"/>
    <to sec="1041397448" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="90.27.221.133"/>
    </slice>
    <from sec="1041397201" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.02037,1.88019,002,1 1 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_877{
style=filled;
color=gray75;
375[label="200.90.91.134s;116pkt 116fpkt", shape=rectangle, color=red];
413[label="216.241.148.149s;157pkt 157fpkt", shape=rectangle, color=red];
1014[label="216.241.148.149s;273pkt 273fpkt", shape=ellipse, color=green];
3940[label="200.90.91.134;115pkt 115fpkt", shape=pentagon, color=darkviolet];
4744[label="200.90.91.134;115pkt 115fpkt", shape=invtriangle, color=brown];
5166[label="200.90.91.134;115pkt 115fpkt", shape=invhouse, color=bisque];
stat877[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.241.148.149:1027, *:137}[57.5092%]&lt;BR/&gt;{200.90.91.134:1036, *:137}[42.4908%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 1036: (32.3793%)&lt;BR/&gt; 1027: (17.6207%)&gt;];
}
375--1014[label="1;116pkt 116fpkt"];
375--1464[label="1;116pkt 116fpkt"];
375--3940[label="1;115pkt 115fpkt"];
375--4744[label="1;115pkt 115fpkt"];
375--5166[label="1;115pkt 115fpkt"];
413--1014[label="1;157pkt 157fpkt"];
413--1464[label="0.961783;151pkt 151fpkt"];
1014--1464[label="0.978022;267pkt 267fpkt"];
1014--3940[label="1;115pkt 115fpkt"];
1014--4744[label="1;115pkt 115fpkt"];
1014--5166[label="1;115pkt 115fpkt"];
3940--4744[label="1;115pkt 115fpkt"];
3940--5166[label="1;115pkt 115fpkt"];
4744--5166[label="1;115pkt 115fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="216.241.148.149" src_port="1027"/>
      <filter dst_port="137" src_ip="200.90.91.134" src_port="1036"/>
    </slice>
    <from sec="1041397313" usec="0"/>
    <to sec="1041397340" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="61.142.196.136"/>
    </slice>
    <from sec="1041397402" usec="0"/>
    <to sec="1041397425" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="70.167.197.136"/>
    </slice>
    <from sec="1041398823" usec="0"/>
    <to sec="1041398824" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="145.228.132.137"/>
    </slice>
    <from sec="1041397276" usec="0"/>
    <to sec="1041397283" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.22.13.138"/>
    </slice>
    <from sec="1041397833" usec="0"/>
    <to sec="1041398211" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.40.109.138"/>
    </slice>
    <from sec="1041397529" usec="0"/>
    <to sec="1041398538" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.243.148.138"/>
    </slice>
    <from sec="1041397982" usec="0"/>
    <to sec="1041398014" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.119.196.138"/>
    </slice>
    <from sec="1041397202" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.142.208.140"/>
    </slice>
    <from sec="1041397285" usec="0"/>
    <to sec="1041398789" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.142.201.141"/>
    </slice>
    <from sec="1041397509" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="216.204.86.144"/>
    </slice>
    <from sec="1041397202" usec="0"/>
    <to sec="1041398820" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.788551,1.83764,002,1 1 1 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_888{
style=filled;
color=gray75;
398[label="216.241.217.144s;184pkt 184fpkt", shape=rectangle, color=red];
1004[label="216.241.217.144s;184pkt 184fpkt", shape=ellipse, color=green];
1458[label="216.241.217.144s;311pkt 311fpkt", shape=triangle, color=blue];
3991[label="216.241.217.144;220pkt 220fpkt", shape=pentagon, color=darkviolet];
stat888[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.241.217.144:1027, *:137}[63.4006%]&lt;BR/&gt;{217.129.11.226:1030, *:137}[36.5994%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 1027: (42.9366%)&lt;BR/&gt; 1030: (7.0634%)&gt;];
}
398--1004[label="1;184pkt 184fpkt"];
398--1458[label="1;184pkt 184fpkt"];
398--3991[label="1;184pkt 184fpkt"];
1004--1458[label="1;184pkt 184fpkt"];
1004--3991[label="1;184pkt 184fpkt"];
1458--3991[label="0.836364;184pkt 184fpkt"];
1458--4308[label="1;127pkt 127fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="216.241.217.144" src_port="1027"/>
      <filter dst_port="137" src_ip="217.129.11.226" src_port="1030"/>
    </slice>
    <from sec="1041397539" usec="0"/>
    <to sec="1041397576" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,501,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="213.22.112.145"/>
    </slice>
    <from sec="1041397213" usec="0"/>
    <to sec="1041397517" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_890{
style=filled;
color=gray75;
401[label="217.51.92.146s;186pkt 186fpkt", shape=rectangle, color=red];
1005[label="217.51.92.146s;186pkt 186fpkt", shape=ellipse, color=green];
1459[label="217.51.92.146s;183pkt 183fpkt", shape=triangle, color=blue];
3995[label="217.51.92.146;185pkt 185fpkt", shape=pentagon, color=darkviolet];
4772[label="217.51.92.146;185pkt 185fpkt", shape=invtriangle, color=brown];
5175[label="217.51.92.146;186pkt 186fpkt", shape=invhouse, color=bisque];
stat890[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.51.92.146:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
401--1005[label="1;186pkt 186fpkt"];
401--1459[label="1;183pkt 183fpkt"];
401--3995[label="1;185pkt 185fpkt"];
401--4772[label="1;185pkt 185fpkt"];
401--5175[label="1;186pkt 186fpkt"];
1005--1459[label="1;183pkt 183fpkt"];
1005--3995[label="1;185pkt 185fpkt"];
1005--4772[label="1;185pkt 185fpkt"];
1005--5175[label="1;186pkt 186fpkt"];
1459--3995[label="0.994536;182pkt 182fpkt"];
1459--4772[label="0.994536;182pkt 182fpkt"];
1459--5175[label="1;183pkt 183fpkt"];
3995--4772[label="1;185pkt 185fpkt"];
3995--5175[label="1;185pkt 185fpkt"];
4772--5175[label="1;185pkt 185fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.51.92.146" src_port="1025"/>
    </slice>
    <from sec="1041397357" usec="0"/>
    <to sec="1041397386" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.649115,1.85851,002,1 1 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_891{
style=filled;
color=gray75;
403[label="217.79.10.147s;153pkt 153fpkt", shape=rectangle, color=red];
1007[label="217.79.10.147s;153pkt 153fpkt", shape=ellipse, color=green];
4000[label="217.79.10.147;155pkt 155fpkt", shape=pentagon, color=darkviolet];
stat891[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.79.10.147:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
403--1007[label="1;153pkt 153fpkt"];
403--3280[label="1;153pkt 153fpkt"];
403--3295[label="1;153pkt 153fpkt"];
403--4000[label="0.993464;152pkt 152fpkt"];
1007--3280[label="1;153pkt 153fpkt"];
1007--3295[label="1;153pkt 153fpkt"];
1007--4000[label="0.993464;152pkt 152fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.79.10.147" src_port="1029"/>
    </slice>
    <from sec="1041398482" usec="0"/>
    <to sec="1041398515" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.54.88.147"/>
    </slice>
    <from sec="1041398792" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="90.76.100.147"/>
    </slice>
    <from sec="1041397204" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="192.229.192.147"/>
    </slice>
    <from sec="1041397233" usec="0"/>
    <to sec="1041398812" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.143.4.149"/>
    </slice>
    <from sec="1041397908" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.226.117.151"/>
    </slice>
    <from sec="1041397574" usec="0"/>
    <to sec="1041397608" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="61.89.134.151"/>
    </slice>
    <from sec="1041398812" usec="0"/>
    <to sec="1041398820" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.820198,1.89686,002,0 0 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_898{
style=filled;
color=gray75;
1466[label="61.163.169.152s;163pkt 163fpkt", shape=triangle, color=blue];
4024[label="61.163.169.152;188pkt 188fpkt", shape=pentagon, color=darkviolet];
4786[label="61.163.169.152;188pkt 188fpkt", shape=invtriangle, color=brown];
stat898[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.163.169.152:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
1466--4024[label="0.993865;162pkt 162fpkt"];
1466--4786[label="0.993865;162pkt 162fpkt"];
4024--4786[label="1;188pkt 188fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.163.169.152" src_port="1027"/>
    </slice>
    <from sec="1041398044" usec="0"/>
    <to sec="1041398073" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.701377,1.87539,002,1 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_899{
style=filled;
color=gray75;
421[label="70.162.58.153s;212pkt 212fpkt", shape=rectangle, color=red];
4026[label="70.162.58.153;247pkt 247fpkt", shape=pentagon, color=darkviolet];
4787[label="70.162.58.153;247pkt 247fpkt", shape=invtriangle, color=brown];
stat899[shape=component, label=&lt;Rules:&lt;BR/&gt;{70.162.58.153:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
421--4026[label="0.995283;211pkt 211fpkt"];
421--4787[label="0.995283;211pkt 211fpkt"];
4026--4787[label="1;247pkt 247fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="70.162.58.153" src_port="1027"/>
    </slice>
    <from sec="1041398338" usec="0"/>
    <to sec="1041398377" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="88.212.112.154"/>
    </slice>
    <from sec="1041398823" usec="0"/>
    <to sec="1041398824" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,501,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="195.12.134.155"/>
    </slice>
    <from sec="1041397503" usec="0"/>
    <to sec="1041397508" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.10027,1.95018,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_902{
style=filled;
color=gray75;
2643[label="144.52.35.158;s;39pkt 39fpkt", shape=diamond, color=yellow];
4047[label="144.52.35.158;47pkt 47fpkt", shape=pentagon, color=darkviolet];
4801[label="144.52.35.158;46pkt 46fpkt", shape=invtriangle, color=brown];
5192[label="144.52.35.158;46pkt 46fpkt", shape=invhouse, color=bisque];
stat902[shape=component, label=&lt;Rules:&lt;BR/&gt;{144.52.35.158:*, *:25}[27.6596%]&lt;BR/&gt;{144.52.35.158:25, 192.213.76.206:*}[21.2766%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (46.6292%)&lt;BR/&gt; 113: (3.37079%)&lt;BR/&gt; 65210: (1.1236%)&lt;BR/&gt; 64625: (1.1236%)&lt;BR/&gt; 56623: (1.1236%)&gt;];
}
2643--4047[label="1;39pkt 39fpkt"];
2643--4801[label="0.974359;38pkt 38fpkt"];
2643--5192[label="0.974359;38pkt 38fpkt"];
4047--4801[label="1;46pkt 46fpkt"];
4047--5192[label="1;46pkt 46fpkt"];
4801--5192[label="1;46pkt 46fpkt"];
</description>
    <slice>
      <filter dst_port="25" src_ip="144.52.35.158"/>
      <filter dst_ip="192.213.76.206" src_ip="144.52.35.158" src_port="25"/>
    </slice>
    <from sec="1041397206" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_903{
style=filled;
color=gray75;
434[label="63.16.40.158s;174pkt 174fpkt", shape=rectangle, color=red];
1032[label="63.16.40.158s;108pkt 108fpkt", shape=ellipse, color=green];
1475[label="63.16.40.158s;108pkt 108fpkt", shape=triangle, color=blue];
4048[label="63.16.40.158;174pkt 174fpkt", shape=pentagon, color=darkviolet];
4802[label="63.16.40.158;174pkt 174fpkt", shape=invtriangle, color=brown];
stat903[shape=component, label=&lt;Rules:&lt;BR/&gt;{63.16.40.158:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
434--1032[label="1;108pkt 108fpkt"];
434--1475[label="1;108pkt 108fpkt"];
434--4048[label="1;174pkt 174fpkt"];
434--4802[label="1;174pkt 174fpkt"];
1032--1475[label="1;108pkt 108fpkt"];
1032--4048[label="1;108pkt 108fpkt"];
1032--4802[label="1;108pkt 108fpkt"];
1475--4048[label="1;108pkt 108fpkt"];
1475--4802[label="1;108pkt 108fpkt"];
4048--4802[label="1;174pkt 174fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="63.16.40.158" src_port="1027"/>
    </slice>
    <from sec="1041398561" usec="0"/>
    <to sec="1041398591" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.184.170.161"/>
    </slice>
    <from sec="1041398241" usec="0"/>
    <to sec="1041398289" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="144.52.71.164"/>
    </slice>
    <from sec="1041397296" usec="0"/>
    <to sec="1041398301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.233.180.165"/>
    </slice>
    <from sec="1041398777" usec="0"/>
    <to sec="1041398807" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.142.194.168"/>
    </slice>
    <from sec="1041397307" usec="0"/>
    <to sec="1041398816" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="216.241.5.169"/>
    </slice>
    <from sec="1041398006" usec="0"/>
    <to sec="1041398024" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.59.17.170"/>
    </slice>
    <from sec="1041397307" usec="0"/>
    <to sec="1041398211" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="193.170.35.170"/>
    </slice>
    <from sec="1041398823" usec="0"/>
    <to sec="1041398824" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.12182,1.93656,020,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_911{
style=filled;
color=gray75;
2067[label="148.132.163.241;s;278pkt 278fpkt", shape=diamond, color=yellow];
2255[label="193.65.125.211;d;7pkt 7fpkt", shape=diamond, color=yellow];
2413[label="148.138.235.226;s;11pkt 11fpkt", shape=diamond, color=yellow];
3020[label="148.132.163.241;s;278pkt 278fpkt", shape=hexagon, color=black];
3075[label="193.65.125.211;d;7pkt 7fpkt", shape=hexagon, color=black];
4100[label="192.59.51.170;4pkt 4fpkt", shape=pentagon, color=darkviolet];
4823[label="192.59.51.170;4pkt 4fpkt", shape=invtriangle, color=brown];
stat911[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.132.163.241:0, *:0}[93.6027%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.3209%)&lt;BR/&gt; 2276: (0.169779%)&lt;BR/&gt; 2260: (0.169779%)&lt;BR/&gt; 1262: (0.169779%)&lt;BR/&gt; 21: (0.169779%)&gt;];
}
2067--2255[label="0.142857;1pkt 1fpkt"];
2067--3020[label="1;278pkt 278fpkt"];
2067--3075[label="0.142857;1pkt 1fpkt"];
2255--2413[label="0.142857;1pkt 1fpkt"];
2255--3020[label="0.142857;1pkt 1fpkt"];
2255--3075[label="1;7pkt 7fpkt"];
2255--4100[label="0.25;1pkt 1fpkt"];
2255--4823[label="0.25;1pkt 1fpkt"];
2413--3075[label="0.142857;1pkt 1fpkt"];
3020--3075[label="0.142857;1pkt 1fpkt"];
3075--4100[label="0.25;1pkt 1fpkt"];
3075--4823[label="0.25;1pkt 1fpkt"];
4100--4823[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter src_ip="148.132.163.241"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398791" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="210.175.181.170"/>
    </slice>
    <from sec="1041398200" usec="0"/>
    <to sec="1041398239" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="210.63.181.171"/>
    </slice>
    <from sec="1041398388" usec="0"/>
    <to sec="1041398429" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.10027,1.95018,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_915{
style=filled;
color=gray75;
1864[label="136.234.117.120;d;395pkt 395fpkt", shape=diamond, color=yellow];
3407[label="210.162.54.17;6pkt 6fpkt", shape=pentagon, color=darkviolet];
3646[label="217.40.165.69;3pkt 3fpkt", shape=pentagon, color=darkviolet];
4112[label="174.71.131.172;5pkt 5fpkt", shape=pentagon, color=darkviolet];
4367[label="174.71.155.243;11pkt 11fpkt", shape=pentagon, color=darkviolet];
4464[label="210.162.54.17;6pkt 6fpkt", shape=invtriangle, color=brown];
4583[label="217.40.165.69;4pkt 4fpkt", shape=invtriangle, color=brown];
5017[label="210.162.54.17;6pkt 6fpkt", shape=invhouse, color=bisque];
5083[label="217.40.165.69;3pkt 3fpkt", shape=invhouse, color=bisque];
stat915[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:80, 136.234.117.120:*}[58.4383%]&lt;BR/&gt;{*:8080, 136.234.117.120:*}[30.9824%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (28.8155%)&lt;BR/&gt; 8080: (16.0592%)&lt;BR/&gt; 3128: (3.30296%)&lt;BR/&gt; 0: (1.36674%)&lt;BR/&gt; 8000: (1.13895%)&gt;];
}
1864--2355[label="0.333333;1pkt 1fpkt"];
1864--2539[label="0.785714;11pkt 11fpkt"];
1864--3006[label="0.333333;1pkt 1fpkt"];
1864--3324[label="0.714286;5pkt 5fpkt"];
1864--3329[label="0.5;1pkt 1fpkt"];
1864--3407[label="0.833333;5pkt 5fpkt"];
1864--3646[label="1;3pkt 3fpkt"];
1864--4112[label="1;5pkt 5fpkt"];
1864--4367[label="0.909091;10pkt 10fpkt"];
1864--4464[label="0.833333;5pkt 5fpkt"];
1864--4583[label="1;4pkt 4fpkt"];
1864--5017[label="0.833333;5pkt 5fpkt"];
1864--5083[label="1;3pkt 3fpkt"];
3407--4464[label="1;6pkt 6fpkt"];
3407--5017[label="1;6pkt 6fpkt"];
3646--4583[label="1;3pkt 3fpkt"];
3646--5083[label="1;3pkt 3fpkt"];
4464--5017[label="1;6pkt 6fpkt"];
4583--5083[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="136.234.117.120" src_port="80"/>
      <filter dst_ip="136.234.117.120" src_port="8080"/>
    </slice>
    <from sec="1041397203" usec="0"/>
    <to sec="1041398772" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.142.205.173"/>
    </slice>
    <from sec="1041397248" usec="0"/>
    <to sec="1041398815" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="210.134.137.175"/>
    </slice>
    <from sec="1041398761" usec="0"/>
    <to sec="1041398788" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.142.194.177"/>
    </slice>
    <from sec="1041397213" usec="0"/>
    <to sec="1041398818" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.768632,1.92929,020,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_919{
style=filled;
color=gray75;
2129[label="148.4.129.182;s;95pkt 95fpkt", shape=diamond, color=yellow];
4141[label="148.4.129.182;101pkt 101fpkt", shape=pentagon, color=darkviolet];
stat919[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.4.129.182:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
2129--4141[label="0.989474;94pkt 94fpkt"];
</description>
    <slice>
      <filter src_ip="148.4.129.182"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.05826,1.93407,002,0 0 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_920{
style=filled;
color=gray75;
1503[label="193.112.7.184s;214pkt 214fpkt", shape=triangle, color=blue];
4148[label="193.112.7.184;213pkt 213fpkt", shape=pentagon, color=darkviolet];
4850[label="193.112.7.184;214pkt 214fpkt", shape=invtriangle, color=brown];
5210[label="193.112.7.184;214pkt 214fpkt", shape=invhouse, color=bisque];
stat920[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.112.7.184:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
1503--4148[label="1;213pkt 213fpkt"];
1503--4850[label="1;214pkt 214fpkt"];
1503--5210[label="1;214pkt 214fpkt"];
4148--4850[label="1;213pkt 213fpkt"];
4148--5210[label="1;213pkt 213fpkt"];
4850--5210[label="1;214pkt 214fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="193.112.7.184" src_port="1028"/>
    </slice>
    <from sec="1041398211" usec="0"/>
    <to sec="1041398244" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="62.131.238.184"/>
    </slice>
    <from sec="1041398823" usec="0"/>
    <to sec="1041398824" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_922{
style=filled;
color=gray75;
489[label="216.84.222.186s;155pkt 155fpkt", shape=rectangle, color=red];
1075[label="216.84.222.186s;155pkt 155fpkt", shape=ellipse, color=green];
1504[label="216.84.222.186s;112pkt 112fpkt", shape=triangle, color=blue];
4153[label="216.84.222.186;176pkt 176fpkt", shape=pentagon, color=darkviolet];
4853[label="216.84.222.186;177pkt 177fpkt", shape=invtriangle, color=brown];
stat922[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.84.222.186:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
489--1075[label="1;155pkt 155fpkt"];
489--1504[label="1;112pkt 112fpkt"];
489--4153[label="0.993548;154pkt 154fpkt"];
489--4853[label="1;155pkt 155fpkt"];
1075--1504[label="1;112pkt 112fpkt"];
1075--4153[label="0.993548;154pkt 154fpkt"];
1075--4853[label="1;155pkt 155fpkt"];
1504--4153[label="0.991071;111pkt 111fpkt"];
1504--4853[label="1;112pkt 112fpkt"];
4153--4853[label="1;176pkt 176fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="216.84.222.186" src_port="1025"/>
    </slice>
    <from sec="1041397806" usec="0"/>
    <to sec="1041397834" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="144.52.22.187"/>
    </slice>
    <from sec="1041397201" usec="0"/>
    <to sec="1041398757" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="61.110.76.187"/>
    </slice>
    <from sec="1041397945" usec="0"/>
    <to sec="1041397977" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.159.200.192"/>
    </slice>
    <from sec="1041397471" usec="0"/>
    <to sec="1041397499" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.142.219.192"/>
    </slice>
    <from sec="1041397269" usec="0"/>
    <to sec="1041398767" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="89.193.149.194"/>
    </slice>
    <from sec="1041397270" usec="0"/>
    <to sec="1041397589" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="91.97.9.195"/>
    </slice>
    <from sec="1041397206" usec="0"/>
    <to sec="1041398821" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.969076,1.91301,002,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_929{
style=filled;
color=gray75;
505[label="217.86.201.195s;114pkt 114fpkt", shape=rectangle, color=red];
4181[label="217.86.201.195;127pkt 127fpkt", shape=pentagon, color=darkviolet];
4871[label="217.86.201.195;126pkt 126fpkt", shape=invtriangle, color=brown];
5220[label="217.86.201.195;127pkt 127fpkt", shape=invhouse, color=bisque];
stat929[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.86.201.195:1178, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1178: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
505--4181[label="1;114pkt 114fpkt"];
505--4871[label="0.991228;113pkt 113fpkt"];
505--5220[label="1;114pkt 114fpkt"];
4181--4871[label="1;126pkt 126fpkt"];
4181--5220[label="1;127pkt 127fpkt"];
4871--5220[label="1;126pkt 126fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.86.201.195" src_port="1178"/>
    </slice>
    <from sec="1041398009" usec="0"/>
    <to sec="1041398030" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,502,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="216.204.28.196"/>
    </slice>
    <from sec="1041398415" usec="0"/>
    <to sec="1041398511" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.05826,1.93407,002,0 0 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_931{
style=filled;
color=gray75;
1585[label="70.132.185.196s;37pkt 37fpkt", shape=triangle, color=blue];
4185[label="70.132.185.196;199pkt 199fpkt", shape=pentagon, color=darkviolet];
4876[label="70.132.185.196;199pkt 199fpkt", shape=invtriangle, color=brown];
5223[label="70.132.185.196;199pkt 199fpkt", shape=invhouse, color=bisque];
stat931[shape=component, label=&lt;Rules:&lt;BR/&gt;{70.132.185.196:*, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 29109: (3.15457%)&lt;BR/&gt; 29114: (2.83912%)&lt;BR/&gt; 29103: (2.83912%)&lt;BR/&gt; 29099: (2.83912%)&gt;];
}
1585--4185[label="1;37pkt 37fpkt"];
1585--4876[label="1;37pkt 37fpkt"];
1585--5223[label="1;37pkt 37fpkt"];
4185--4876[label="1;199pkt 199fpkt"];
4185--5223[label="1;199pkt 199fpkt"];
4876--5223[label="1;199pkt 199fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="70.132.185.196"/>
    </slice>
    <from sec="1041397392" usec="0"/>
    <to sec="1041397422" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="70.160.180.197"/>
    </slice>
    <from sec="1041397204" usec="0"/>
    <to sec="1041398822" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.1.136.199"/>
    </slice>
    <from sec="1041397964" usec="0"/>
    <to sec="1041397976" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="216.204.19.200"/>
    </slice>
    <from sec="1041398199" usec="0"/>
    <to sec="1041398276" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.565075,1.89171,002,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_935{
style=filled;
color=gray75;
635[label="4.141.193.200s;177pkt 177fpkt", shape=rectangle, color=red];
4204[label="4.141.193.200;176pkt 176fpkt", shape=pentagon, color=darkviolet];
stat935[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.141.193.200:*, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 56994: (0.283286%)&lt;BR/&gt; 56993: (0.283286%)&lt;BR/&gt; 56992: (0.283286%)&lt;BR/&gt; 56991: (0.283286%)&gt;];
}
635--4204[label="1;176pkt 176fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="4.141.193.200"/>
    </slice>
    <from sec="1041397710" usec="0"/>
    <to sec="1041397737" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="165.242.44.202"/>
    </slice>
    <from sec="1041397227" usec="0"/>
    <to sec="1041398822" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.59.21.203"/>
    </slice>
    <from sec="1041397535" usec="0"/>
    <to sec="1041398576" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="88.147.212.204"/>
    </slice>
    <from sec="1041398692" usec="0"/>
    <to sec="1041398728" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.565075,1.89171,002,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_939{
style=filled;
color=gray75;
522[label="61.198.9.206s;125pkt 125fpkt", shape=rectangle, color=red];
4227[label="61.198.9.206;138pkt 138fpkt", shape=pentagon, color=darkviolet];
stat939[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.198.9.206:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
522--4227[label="1;125pkt 125fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.198.9.206" src_port="1026"/>
    </slice>
    <from sec="1041398307" usec="0"/>
    <to sec="1041398335" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.649115,1.85851,002,1 1 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_940{
style=filled;
color=gray75;
525[label="90.18.73.207s;91pkt 91fpkt", shape=rectangle, color=red];
1100[label="90.18.73.207s;91pkt 91fpkt", shape=ellipse, color=green];
4232[label="90.18.73.207;134pkt 134fpkt", shape=pentagon, color=darkviolet];
stat940[shape=component, label=&lt;Rules:&lt;BR/&gt;{90.18.73.207:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
525--1100[label="1;91pkt 91fpkt"];
525--3280[label="1;91pkt 91fpkt"];
525--3295[label="1;91pkt 91fpkt"];
525--4232[label="1;91pkt 91fpkt"];
1100--3280[label="1;91pkt 91fpkt"];
1100--3295[label="1;91pkt 91fpkt"];
1100--4232[label="1;91pkt 91fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="90.18.73.207" src_port="1025"/>
    </slice>
    <from sec="1041398470" usec="0"/>
    <to sec="1041398492" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="195.185.160.209"/>
    </slice>
    <from sec="1041398770" usec="0"/>
    <to sec="1041398806" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.65.249.212"/>
    </slice>
    <from sec="1041398823" usec="0"/>
    <to sec="1041398824" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="93.178.108.213"/>
    </slice>
    <from sec="1041397623" usec="0"/>
    <to sec="1041398762" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="71.233.130.214"/>
    </slice>
    <from sec="1041397676" usec="0"/>
    <to sec="1041397696" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.969076,1.91301,002,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_945{
style=filled;
color=gray75;
533[label="202.90.1.215s;225pkt 225fpkt", shape=rectangle, color=red];
4260[label="202.90.1.215;224pkt 224fpkt", shape=pentagon, color=darkviolet];
4919[label="202.90.1.215;224pkt 224fpkt", shape=invtriangle, color=brown];
5245[label="202.90.1.215;224pkt 224fpkt", shape=invhouse, color=bisque];
stat945[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.90.1.215:1024, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1024: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
533--4260[label="1;224pkt 224fpkt"];
533--4919[label="1;224pkt 224fpkt"];
533--5245[label="1;224pkt 224fpkt"];
4260--4919[label="1;224pkt 224fpkt"];
4260--5245[label="1;224pkt 224fpkt"];
4919--5245[label="1;224pkt 224fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="202.90.1.215" src_port="1024"/>
    </slice>
    <from sec="1041398142" usec="0"/>
    <to sec="1041398177" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="136.234.78.215"/>
    </slice>
    <from sec="1041398823" usec="0"/>
    <to sec="1041398824" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.172.9.216"/>
    </slice>
    <from sec="1041398551" usec="0"/>
    <to sec="1041398560" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757634,1.96858,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_948{
style=filled;
color=gray75;
2566[label="193.135.115.12;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat948[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.142.141.216:3583, 193.135.115.12:25}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3583: (50%)&lt;BR/&gt; 25: (50%)&gt;];
}
2566--4270[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="193.135.115.12" dst_port="25" src_ip="172.142.141.216" src_port="3583"/>
    </slice>
    <from sec="1041398340" usec="0"/>
    <to sec="1041398512" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.65.20.217"/>
    </slice>
    <from sec="1041397712" usec="0"/>
    <to sec="1041398819" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="136.234.237.218"/>
    </slice>
    <from sec="1041397520" usec="0"/>
    <to sec="1041398750" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.65.20.220"/>
    </slice>
    <from sec="1041398055" usec="0"/>
    <to sec="1041398794" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="213.242.39.220"/>
    </slice>
    <from sec="1041398028" usec="0"/>
    <to sec="1041398241" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.768632,1.92929,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_953{
style=filled;
color=gray75;
1727[label="70.161.33.221;s;1pkt 1fpkt", shape=diamond, color=yellow];
4297[label="70.161.33.221;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat953[shape=component, label=&lt;Rules:&lt;BR/&gt;{70.161.33.221:4662, 168.125.47.240:1657}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4662: (50%)&lt;BR/&gt; 1657: (50%)&gt;];
}
1727--4297[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="168.125.47.240" dst_port="1657" src_ip="70.161.33.221" src_port="4662"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.49.131.227"/>
    </slice>
    <from sec="1041398227" usec="0"/>
    <to sec="1041398311" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.59.16.229"/>
    </slice>
    <from sec="1041397203" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.65.20.234"/>
    </slice>
    <from sec="1041397211" usec="0"/>
    <to sec="1041398052" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.969076,1.91301,002,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_958{
style=filled;
color=gray75;
579[label="61.235.202.235s;171pkt 171fpkt", shape=rectangle, color=red];
4341[label="61.235.202.235;171pkt 171fpkt", shape=pentagon, color=darkviolet];
4964[label="61.235.202.235;171pkt 171fpkt", shape=invtriangle, color=brown];
5273[label="61.235.202.235;171pkt 171fpkt", shape=invhouse, color=bisque];
stat958[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.235.202.235:1031, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1031: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
579--4341[label="1;171pkt 171fpkt"];
579--4964[label="1;171pkt 171fpkt"];
579--5273[label="1;171pkt 171fpkt"];
4341--4964[label="1;171pkt 171fpkt"];
4341--5273[label="1;171pkt 171fpkt"];
4964--5273[label="1;171pkt 171fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.235.202.235" src_port="1031"/>
    </slice>
    <from sec="1041398395" usec="0"/>
    <to sec="1041398423" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="168.125.225.235"/>
    </slice>
    <from sec="1041397202" usec="0"/>
    <to sec="1041398813" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.65.20.237"/>
    </slice>
    <from sec="1041397412" usec="0"/>
    <to sec="1041398761" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.30601,1.97302,503,0 0 0 1 1 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_961{
style=filled;
color=gray75;
2042[label="136.234.76.249;d;321pkt 321fpkt", shape=diamond, color=yellow];
2872[label="136.234.76.249;d;152pkt 152fpkt", shape=hexagon, color=black];
4039[label="88.212.117.156;21pkt 21fpkt", shape=pentagon, color=darkviolet];
4050[label="88.212.117.158;22pkt 22fpkt", shape=pentagon, color=darkviolet];
4056[label="88.212.117.159;15pkt 15fpkt", shape=pentagon, color=darkviolet];
4245[label="88.212.117.211;21pkt 21fpkt", shape=pentagon, color=darkviolet];
4349[label="88.212.117.237;24pkt 24fpkt", shape=pentagon, color=darkviolet];
4803[label="88.212.117.158;22pkt 22fpkt", shape=invtriangle, color=brown];
4805[label="88.212.117.159;15pkt 15fpkt", shape=invtriangle, color=brown];
5193[label="88.212.117.158;21pkt 21fpkt", shape=invhouse, color=bisque];
stat961[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 136.234.76.249:80}[96.6867%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.6593%)&lt;BR/&gt; 53: (0.709779%)&lt;BR/&gt; 63691: (0.394322%)&lt;BR/&gt; 62646: (0.394322%)&lt;BR/&gt; 60620: (0.394322%)&gt;];
}
2042--2486[label="0.0333333;1pkt 1fpkt"];
2042--2872[label="1;152pkt 152fpkt"];
2042--3096[label="0.0333333;1pkt 1fpkt"];
2042--3263[label="0.0454545;1pkt 1fpkt"];
2042--3275[label="0.0280374;9pkt 9fpkt"];
2042--3279[label="0.0124611;4pkt 4fpkt"];
2042--3283[label="0.00623053;2pkt 2fpkt"];
2042--3284[label="0.0155763;5pkt 5fpkt"];
2042--3289[label="0.0280374;9pkt 9fpkt"];
2042--3294[label="0.0124611;4pkt 4fpkt"];
2042--3298[label="0.0280374;9pkt 9fpkt"];
2042--3349[label="0.0142857;1pkt 1fpkt"];
2042--3409[label="0.0684932;5pkt 5fpkt"];
2042--3660[label="0.0123457;1pkt 1fpkt"];
2042--3668[label="0.0178571;2pkt 2fpkt"];
2042--4039[label="1;21pkt 21fpkt"];
2042--4050[label="0.681818;15pkt 15fpkt"];
2042--4056[label="0.933333;14pkt 14fpkt"];
2042--4078[label="0.0461538;3pkt 3fpkt"];
2042--4245[label="1;21pkt 21fpkt"];
2042--4349[label="0.875;21pkt 21fpkt"];
2042--4588[label="0.0121951;1pkt 1fpkt"];
2042--4803[label="0.681818;15pkt 15fpkt"];
2042--4805[label="0.933333;14pkt 14fpkt"];
2042--5086[label="0.0123457;1pkt 1fpkt"];
2042--5193[label="0.714286;15pkt 15fpkt"];
2872--3275[label="0.0592105;9pkt 9fpkt"];
2872--3289[label="0.0592105;9pkt 9fpkt"];
2872--3298[label="0.0592105;9pkt 9fpkt"];
2872--3409[label="0.0273973;2pkt 2fpkt"];
2872--4039[label="0.428571;9pkt 9fpkt"];
2872--4050[label="0.272727;6pkt 6fpkt"];
2872--4056[label="0.466667;7pkt 7fpkt"];
2872--4245[label="0.619048;13pkt 13fpkt"];
2872--4349[label="0.458333;11pkt 11fpkt"];
2872--4803[label="0.272727;6pkt 6fpkt"];
2872--4805[label="0.466667;7pkt 7fpkt"];
2872--5193[label="0.285714;6pkt 6fpkt"];
4050--4803[label="1;22pkt 22fpkt"];
4050--5193[label="1;21pkt 21fpkt"];
4056--4805[label="1;15pkt 15fpkt"];
4803--5193[label="1;21pkt 21fpkt"];
</description>
    <slice>
      <filter dst_ip="136.234.76.249" dst_port="80"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398747" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.65.20.239"/>
    </slice>
    <from sec="1041397912" usec="0"/>
    <to sec="1041398122" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="91.33.129.240"/>
    </slice>
    <from sec="1041398648" usec="0"/>
    <to sec="1041398664" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.969076,1.91301,002,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_964{
style=filled;
color=gray75;
594[label="202.19.170.241s;174pkt 174fpkt", shape=rectangle, color=red];
4363[label="202.19.170.241;174pkt 174fpkt", shape=pentagon, color=darkviolet];
4974[label="202.19.170.241;173pkt 173fpkt", shape=invtriangle, color=brown];
5280[label="202.19.170.241;173pkt 173fpkt", shape=invhouse, color=bisque];
stat964[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.19.170.241:1033, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1033: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
594--4363[label="1;174pkt 174fpkt"];
594--4974[label="1;173pkt 173fpkt"];
594--5280[label="1;173pkt 173fpkt"];
4363--4974[label="1;173pkt 173fpkt"];
4363--5280[label="1;173pkt 173fpkt"];
4974--5280[label="1;173pkt 173fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="202.19.170.241" src_port="1033"/>
    </slice>
    <from sec="1041398194" usec="0"/>
    <to sec="1041398221" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.565075,1.89171,002,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_966{
style=filled;
color=gray75;
595[label="217.134.199.242s;154pkt 154fpkt", shape=rectangle, color=red];
4366[label="217.134.199.242;154pkt 154fpkt", shape=pentagon, color=darkviolet];
stat966[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.134.199.242:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
595--4366[label="1;154pkt 154fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.134.199.242" src_port="1026"/>
    </slice>
    <from sec="1041397338" usec="0"/>
    <to sec="1041397371" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,502,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="216.204.7.244"/>
    </slice>
    <from sec="1041397203" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.65.20.249"/>
    </slice>
    <from sec="1041397581" usec="0"/>
    <to sec="1041398813" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="136.234.68.249"/>
    </slice>
    <from sec="1041397211" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="71.233.240.249"/>
    </slice>
    <from sec="1041398823" usec="0"/>
    <to sec="1041398824" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.65.20.250"/>
    </slice>
    <from sec="1041398098" usec="0"/>
    <to sec="1041398822" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="168.125.47.250"/>
    </slice>
    <from sec="1041397302" usec="0"/>
    <to sec="1041398786" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="210.115.159.250"/>
    </slice>
    <from sec="1041398301" usec="0"/>
    <to sec="1041398322" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.969076,1.91301,002,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_975{
style=filled;
color=gray75;
607[label="61.229.9.253s;231pkt 231fpkt", shape=rectangle, color=red];
4392[label="61.229.9.253;247pkt 247fpkt", shape=pentagon, color=darkviolet];
4986[label="61.229.9.253;247pkt 247fpkt", shape=invtriangle, color=brown];
5289[label="61.229.9.253;247pkt 247fpkt", shape=invhouse, color=bisque];
stat975[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.229.9.253:1031, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1031: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
607--4392[label="1;231pkt 231fpkt"];
607--4986[label="1;231pkt 231fpkt"];
607--5289[label="1;231pkt 231fpkt"];
4392--4986[label="1;247pkt 247fpkt"];
4392--5289[label="1;247pkt 247fpkt"];
4986--5289[label="1;247pkt 247fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.229.9.253" src_port="1031"/>
    </slice>
    <from sec="1041397453" usec="0"/>
    <to sec="1041397515" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.65.20.253"/>
    </slice>
    <from sec="1041397688" usec="0"/>
    <to sec="1041398063" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.02037,1.88019,002,1 1 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_977{
style=filled;
color=gray75;
608[label="88.125.209.255s;163pkt 163fpkt", shape=rectangle, color=red];
1164[label="88.125.209.255s;100pkt 100fpkt", shape=ellipse, color=green];
4398[label="88.125.209.255;179pkt 179fpkt", shape=pentagon, color=darkviolet];
4990[label="88.125.209.255;179pkt 179fpkt", shape=invtriangle, color=brown];
5292[label="88.125.209.255;178pkt 178fpkt", shape=invhouse, color=bisque];
stat977[shape=component, label=&lt;Rules:&lt;BR/&gt;{88.125.209.255:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
608--1164[label="1;100pkt 100fpkt"];
608--4398[label="1;163pkt 163fpkt"];
608--4990[label="1;163pkt 163fpkt"];
608--5292[label="0.993865;162pkt 162fpkt"];
1164--4398[label="1;100pkt 100fpkt"];
1164--4990[label="1;100pkt 100fpkt"];
1164--5292[label="0.99;99pkt 99fpkt"];
4398--4990[label="1;179pkt 179fpkt"];
4398--5292[label="1;178pkt 178fpkt"];
4990--5292[label="1;178pkt 178fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="88.125.209.255" src_port="1029"/>
    </slice>
    <from sec="1041397391" usec="0"/>
    <to sec="1041397419" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="90.2.76.0"/>
    </slice>
    <from sec="1041397208" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="148.138.205.0"/>
    </slice>
    <from sec="1041398019" usec="0"/>
    <to sec="1041398047" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="213.105.49.1"/>
    </slice>
    <from sec="1041397483" usec="0"/>
    <to sec="1041397540" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="193.95.126.2"/>
    </slice>
    <from sec="1041398303" usec="0"/>
    <to sec="1041398316" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.958875,1.95391,501,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_982{
style=filled;
color=gray75;
3326[label="144.52.236.3;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4416[label="144.52.236.3;2pkt 2fpkt", shape=invtriangle, color=brown];
4997[label="144.52.236.3;2pkt 2fpkt", shape=invhouse, color=bisque];
stat982[shape=component, label=&lt;Rules:&lt;BR/&gt;{144.52.236.3:34771, 195.12.134.155:21}[50%]&lt;BR/&gt;{144.52.236.3:34772, 195.12.134.155:4751}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 34772: (30%)&lt;BR/&gt; 4751: (30%)&lt;BR/&gt; 34771: (20%)&lt;BR/&gt; 21: (20%)&gt;];
}
3326--4416[label="1;1pkt 1fpkt"];
3326--4997[label="1;1pkt 1fpkt"];
4416--4997[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="195.12.134.155" dst_port="4751" src_ip="144.52.236.3" src_port="34772"/>
      <filter dst_ip="195.12.134.155" dst_port="21" src_ip="144.52.236.3" src_port="34771"/>
    </slice>
    <from sec="1041397503" usec="0"/>
    <to sec="1041397508" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_983{
style=filled;
color=gray75;
3334[label="89.2.40.5;218pkt 218fpkt", shape=pentagon, color=darkviolet];
4419[label="89.2.40.5;218pkt 218fpkt", shape=invtriangle, color=brown];
stat983[shape=component, label=&lt;Rules:&lt;BR/&gt;{89.2.40.5:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3334--4419[label="1;218pkt 218fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="89.2.40.5" src_port="1028"/>
    </slice>
    <from sec="1041397639" usec="0"/>
    <to sec="1041397687" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_984{
style=filled;
color=gray75;
3340[label="206.226.160.5;4pkt 4fpkt", shape=pentagon, color=darkviolet];
4424[label="206.226.160.5;4pkt 4fpkt", shape=invtriangle, color=brown];
stat984[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.226.160.5:80, 203.11.204.206:58913}[25%]&lt;BR/&gt;{206.226.160.5:80, 203.11.204.206:58916}[25%]&lt;BR/&gt;{206.226.160.5:80, 203.11.204.206:58917}[25%]&lt;BR/&gt;{206.226.160.5:80, 203.11.204.206:58918}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 58918: (12.5%)&lt;BR/&gt; 58917: (12.5%)&lt;BR/&gt; 58916: (12.5%)&lt;BR/&gt; 58913: (12.5%)&gt;];
}
3340--4424[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="203.11.204.206" dst_port="58918" src_ip="206.226.160.5" src_port="80"/>
      <filter dst_ip="203.11.204.206" dst_port="58917" src_ip="206.226.160.5" src_port="80"/>
      <filter dst_ip="203.11.204.206" dst_port="58916" src_ip="206.226.160.5" src_port="80"/>
      <filter dst_ip="203.11.204.206" dst_port="58913" src_ip="206.226.160.5" src_port="80"/>
    </slice>
    <from sec="1041398767" usec="0"/>
    <to sec="1041398791" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_985{
style=filled;
color=gray75;
3356[label="209.135.40.8;3pkt 3fpkt", shape=pentagon, color=darkviolet];
4432[label="209.135.40.8;3pkt 3fpkt", shape=invtriangle, color=brown];
stat985[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.135.40.8:80, 136.146.36.172:43882}[33.3333%]&lt;BR/&gt;{209.135.40.8:80, 203.11.204.206:58949}[33.3333%]&lt;BR/&gt;{209.135.40.8:80, 203.11.204.206:58960}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 58960: (16.6667%)&lt;BR/&gt; 58949: (16.6667%)&lt;BR/&gt; 43882: (16.6667%)&gt;];
}
3356--4432[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="203.11.204.206" dst_port="58960" src_ip="209.135.40.8" src_port="80"/>
      <filter dst_ip="203.11.204.206" dst_port="58949" src_ip="209.135.40.8" src_port="80"/>
      <filter dst_ip="136.146.36.172" dst_port="43882" src_ip="209.135.40.8" src_port="80"/>
    </slice>
    <from sec="1041398768" usec="0"/>
    <to sec="1041398787" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="148.155.247.8"/>
    </slice>
    <from sec="1041397725" usec="0"/>
    <to sec="1041398086" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.958875,1.95391,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_987{
style=filled;
color=gray75;
3365[label="61.19.2.9;169pkt 169fpkt", shape=pentagon, color=darkviolet];
4438[label="61.19.2.9;170pkt 170fpkt", shape=invtriangle, color=brown];
5006[label="61.19.2.9;170pkt 170fpkt", shape=invhouse, color=bisque];
stat987[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.19.2.9:64437, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 64437: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3365--4438[label="1;169pkt 169fpkt"];
3365--5006[label="1;169pkt 169fpkt"];
4438--5006[label="1;170pkt 170fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.19.2.9" src_port="64437"/>
    </slice>
    <from sec="1041397732" usec="0"/>
    <to sec="1041397771" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_988{
style=filled;
color=gray75;
3368[label="202.176.175.10;4pkt 4fpkt", shape=pentagon, color=darkviolet];
4441[label="202.176.175.10;4pkt 4fpkt", shape=invtriangle, color=brown];
stat988[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.176.175.10:80, 202.145.26.195:3313}[25%]&lt;BR/&gt;{202.176.175.10:80, 202.145.26.195:3315}[25%]&lt;BR/&gt;{202.176.175.10:80, 202.145.26.195:3317}[25%]&lt;BR/&gt;{202.176.175.10:80, 202.145.26.195:3357}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3357: (12.5%)&lt;BR/&gt; 3317: (12.5%)&lt;BR/&gt; 3315: (12.5%)&lt;BR/&gt; 3313: (12.5%)&gt;];
}
3368--4441[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="202.145.26.195" dst_port="3357" src_ip="202.176.175.10" src_port="80"/>
      <filter dst_ip="202.145.26.195" dst_port="3317" src_ip="202.176.175.10" src_port="80"/>
      <filter dst_ip="202.145.26.195" dst_port="3315" src_ip="202.176.175.10" src_port="80"/>
      <filter dst_ip="202.145.26.195" dst_port="3313" src_ip="202.176.175.10" src_port="80"/>
    </slice>
    <from sec="1041397319" usec="0"/>
    <to sec="1041397386" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_989{
style=filled;
color=gray75;
3382[label="202.55.98.12;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4449[label="202.55.98.12;1pkt 1fpkt", shape=invtriangle, color=brown];
stat989[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.55.98.12:8080, 168.125.224.25:3485}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8080: (50%)&lt;BR/&gt; 3485: (50%)&gt;];
}
3382--4449[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="168.125.224.25" dst_port="3485" src_ip="202.55.98.12" src_port="8080"/>
    </slice>
    <from sec="1041398823" usec="0"/>
    <to sec="1041398824" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_990{
style=filled;
color=gray75;
3383[label="172.142.214.12;8pkt 8fpkt", shape=pentagon, color=darkviolet];
4450[label="172.142.214.12;8pkt 8fpkt", shape=invtriangle, color=brown];
stat990[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.142.214.12:80, 210.45.139.13:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1216: (6.25%)&lt;BR/&gt; 1215: (6.25%)&lt;BR/&gt; 1214: (6.25%)&lt;BR/&gt; 1213: (6.25%)&gt;];
}
3383--4450[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="210.45.139.13" src_ip="172.142.214.12" src_port="80"/>
    </slice>
    <from sec="1041398164" usec="0"/>
    <to sec="1041398562" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="211.125.103.14"/>
    </slice>
    <from sec="1041397963" usec="0"/>
    <to sec="1041397979" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,504,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_992{
style=filled;
color=gray75;
3393[label="168.125.148.14;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4456[label="168.125.148.14;1pkt 1fpkt", shape=invtriangle, color=brown];
stat992[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.125.148.14:4003, 89.102.71.178:443}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4003: (50%)&lt;BR/&gt; 443: (50%)&gt;];
}
3393--4456[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="89.102.71.178" dst_port="443" src_ip="168.125.148.14" src_port="4003"/>
    </slice>
    <from sec="1041397305" usec="0"/>
    <to sec="1041397315" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.958875,1.95391,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_993{
style=filled;
color=gray75;
3403[label="136.234.119.16;3pkt 3fpkt", shape=pentagon, color=darkviolet];
4461[label="136.234.119.16;4pkt 4fpkt", shape=invtriangle, color=brown];
5015[label="136.234.119.16;4pkt 4fpkt", shape=invhouse, color=bisque];
stat993[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.119.16:1040, 205.65.18.120:1863}[25%]&lt;BR/&gt;{136.234.119.16:2099, 205.65.20.210:1863}[25%]&lt;BR/&gt;{136.234.119.16:137, 211.161.85.74:137}[25%]&lt;BR/&gt;{136.234.119.16:2303, 211.161.85.74:2111}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1863: (27.2727%)&lt;BR/&gt; 137: (18.1818%)&lt;BR/&gt; 2303: (13.6364%)&lt;BR/&gt; 2111: (13.6364%)&lt;BR/&gt; 2099: (13.6364%)&gt;];
}
3403--4461[label="1;3pkt 3fpkt"];
3403--5015[label="1;3pkt 3fpkt"];
4461--5015[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="211.161.85.74" dst_port="2111" src_ip="136.234.119.16" src_port="2303"/>
      <filter dst_ip="211.161.85.74" dst_port="137" src_ip="136.234.119.16" src_port="137"/>
      <filter dst_ip="205.65.20.210" dst_port="1863" src_ip="136.234.119.16" src_port="2099"/>
      <filter dst_ip="205.65.18.120" dst_port="1863" src_ip="136.234.119.16" src_port="1040"/>
    </slice>
    <from sec="1041397518" usec="0"/>
    <to sec="1041398822" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,501,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_994{
style=filled;
color=gray75;
3423[label="172.142.208.19;16pkt 16fpkt", shape=pentagon, color=darkviolet];
4472[label="172.142.208.19;17pkt 17fpkt", shape=invtriangle, color=brown];
stat994[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.142.208.19:*, 88.186.149.34:21}[70.5882%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (36.3636%)&lt;BR/&gt; 5050: (6.06061%)&lt;BR/&gt; 5190: (3.0303%)&lt;BR/&gt; 4117: (3.0303%)&lt;BR/&gt; 4053: (3.0303%)&gt;];
}
3423--4472[label="1;16pkt 16fpkt"];
</description>
    <slice>
      <filter dst_ip="88.186.149.34" dst_port="21" src_ip="172.142.208.19"/>
    </slice>
    <from sec="1041397219" usec="0"/>
    <to sec="1041398711" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_995{
style=filled;
color=gray75;
3425[label="216.204.21.20;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4473[label="216.204.21.20;1pkt 1fpkt", shape=invtriangle, color=brown];
stat995[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.204.21.20:3332, 203.59.17.230:110}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3332: (50%)&lt;BR/&gt; 110: (50%)&gt;];
}
3425--4473[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="203.59.17.230" dst_port="110" src_ip="216.204.21.20" src_port="3332"/>
    </slice>
    <from sec="1041398513" usec="0"/>
    <to sec="1041398652" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="63.21.80.21"/>
    </slice>
    <from sec="1041397695" usec="0"/>
    <to sec="1041397764" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.958875,1.95391,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_997{
style=filled;
color=gray75;
3438[label="148.4.130.22;21pkt 21fpkt", shape=pentagon, color=darkviolet];
4477[label="148.4.130.22;21pkt 21fpkt", shape=invtriangle, color=brown];
5023[label="148.4.130.22;21pkt 21fpkt", shape=invhouse, color=bisque];
stat997[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.4.130.22:80, *:*}[28.5714%]&lt;BR/&gt;{148.4.130.22:*, 90.205.173.199:25}[23.8095%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (35.7143%)&lt;BR/&gt; 80: (14.2857%)&lt;BR/&gt; 44636: (2.38095%)&lt;BR/&gt; 40201: (2.38095%)&lt;BR/&gt; 21855: (2.38095%)&gt;];
}
3438--4477[label="1;21pkt 21fpkt"];
3438--5023[label="1;21pkt 21fpkt"];
4477--5023[label="1;21pkt 21fpkt"];
</description>
    <slice>
      <filter src_ip="148.4.130.22" src_port="80"/>
      <filter dst_ip="90.205.173.199" dst_port="25" src_ip="148.4.130.22"/>
    </slice>
    <from sec="1041397604" usec="0"/>
    <to sec="1041398802" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.958875,1.95391,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_998{
style=filled;
color=gray75;
3442[label="217.70.17.23;122pkt 122fpkt", shape=pentagon, color=darkviolet];
4478[label="217.70.17.23;122pkt 122fpkt", shape=invtriangle, color=brown];
5025[label="217.70.17.23;121pkt 121fpkt", shape=invhouse, color=bisque];
stat998[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.70.17.23:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3442--4478[label="1;122pkt 122fpkt"];
3442--5025[label="1;121pkt 121fpkt"];
4478--5025[label="1;121pkt 121fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.70.17.23" src_port="1028"/>
    </slice>
    <from sec="1041397567" usec="0"/>
    <to sec="1041397586" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_999{
style=filled;
color=gray75;
3449[label="209.162.179.24;228pkt 228fpkt", shape=pentagon, color=darkviolet];
4480[label="209.162.179.24;228pkt 228fpkt", shape=invtriangle, color=brown];
stat999[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.162.179.24:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3449--4480[label="1;228pkt 228fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="209.162.179.24" src_port="1025"/>
    </slice>
    <from sec="1041398534" usec="0"/>
    <to sec="1041398570" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="93.56.34.25"/>
    </slice>
    <from sec="1041397215" usec="0"/>
    <to sec="1041398820" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.969076,1.91301,002,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1001{
style=filled;
color=gray75;
155[label="23.79.221.26s;211pkt 211fpkt", shape=rectangle, color=red];
3463[label="23.79.221.26;211pkt 211fpkt", shape=pentagon, color=darkviolet];
4486[label="23.79.221.26;210pkt 210fpkt", shape=invtriangle, color=brown];
5030[label="23.79.221.26;211pkt 211fpkt", shape=invhouse, color=bisque];
stat1001[shape=component, label=&lt;Rules:&lt;BR/&gt;{23.79.221.26:32994, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 32994: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
155--3463[label="1;211pkt 211fpkt"];
155--4486[label="1;210pkt 210fpkt"];
155--5030[label="1;211pkt 211fpkt"];
3463--4486[label="1;210pkt 210fpkt"];
3463--5030[label="1;211pkt 211fpkt"];
4486--5030[label="1;210pkt 210fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="23.79.221.26" src_port="32994"/>
    </slice>
    <from sec="1041397590" usec="0"/>
    <to sec="1041397631" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,020,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1002{
style=filled;
color=gray75;
3465[label="172.142.73.27;15pkt 15fpkt", shape=pentagon, color=darkviolet];
4488[label="172.142.73.27;15pkt 15fpkt", shape=invtriangle, color=brown];
stat1002[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.142.73.27:25, *:*}[60%]&lt;BR/&gt;{172.142.73.27:0, *:0}[40%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (40%)&lt;BR/&gt; 25: (30%)&lt;BR/&gt; 52654: (3.33333%)&lt;BR/&gt; 51790: (3.33333%)&lt;BR/&gt; 51400: (3.33333%)&gt;];
}
3465--4488[label="1;15pkt 15fpkt"];
</description>
    <slice>
      <filter src_ip="172.142.73.27" src_port="25"/>
      <filter src_ip="172.142.73.27"/>
    </slice>
    <from sec="1041397202" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.958875,1.95391,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1003{
style=filled;
color=gray75;
3469[label="203.217.73.28;148pkt 148fpkt", shape=pentagon, color=darkviolet];
4491[label="203.217.73.28;147pkt 147fpkt", shape=invtriangle, color=brown];
5034[label="203.217.73.28;148pkt 148fpkt", shape=invhouse, color=bisque];
stat1003[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.217.73.28:1026, *:137}[50.6757%]&lt;BR/&gt;{203.217.73.28:1029, *:137}[49.3243%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 1026: (25.395%)&lt;BR/&gt; 1029: (24.605%)&gt;];
}
3469--4491[label="1;147pkt 147fpkt"];
3469--5034[label="1;148pkt 148fpkt"];
4491--5034[label="1;147pkt 147fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="203.217.73.28" src_port="1026"/>
      <filter dst_port="137" src_ip="203.217.73.28" src_port="1029"/>
    </slice>
    <from sec="1041397592" usec="0"/>
    <to sec="1041397793" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1004{
style=filled;
color=gray75;
614[label="61.196.119.33s;193pkt 193fpkt", shape=rectangle, color=red];
1169[label="61.196.119.33s;193pkt 193fpkt", shape=ellipse, color=green];
1573[label="61.196.119.33s;96pkt 96fpkt", shape=triangle, color=blue];
3491[label="61.196.119.33;195pkt 195fpkt", shape=pentagon, color=darkviolet];
4500[label="61.196.119.33;194pkt 194fpkt", shape=invtriangle, color=brown];
5038[label="61.196.119.33;194pkt 194fpkt", shape=invhouse, color=bisque];
stat1004[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.196.119.33:*, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 42682: (0.28169%)&lt;BR/&gt; 42680: (0.28169%)&lt;BR/&gt; 42678: (0.28169%)&lt;BR/&gt; 42676: (0.28169%)&gt;];
}
614--1169[label="1;193pkt 193fpkt"];
614--1573[label="1;96pkt 96fpkt"];
614--3491[label="1;193pkt 193fpkt"];
614--4500[label="0.994819;192pkt 192fpkt"];
614--5038[label="0.994819;192pkt 192fpkt"];
1169--1573[label="1;96pkt 96fpkt"];
1169--3491[label="1;193pkt 193fpkt"];
1169--4500[label="0.994819;192pkt 192fpkt"];
1169--5038[label="0.994819;192pkt 192fpkt"];
1573--3491[label="1;96pkt 96fpkt"];
1573--4500[label="1;96pkt 96fpkt"];
1573--5038[label="1;96pkt 96fpkt"];
3491--4500[label="1;194pkt 194fpkt"];
3491--5038[label="1;194pkt 194fpkt"];
4500--5038[label="1;194pkt 194fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.196.119.33"/>
    </slice>
    <from sec="1041398205" usec="0"/>
    <to sec="1041398237" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1005{
style=filled;
color=gray75;
3503[label="202.145.206.36;66pkt 66fpkt", shape=pentagon, color=darkviolet];
4508[label="202.145.206.36;67pkt 67fpkt", shape=invtriangle, color=brown];
stat1005[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.145.206.36:*, 88.129.40.32:80}[37.3134%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (46.6165%)&lt;BR/&gt; 5190: (1.50376%)&lt;BR/&gt; 19767: (0.75188%)&lt;BR/&gt; 1110: (0.75188%)&lt;BR/&gt; 1108: (0.75188%)&gt;];
}
3503--4508[label="1;66pkt 66fpkt"];
</description>
    <slice>
      <filter dst_ip="88.129.40.32" dst_port="80" src_ip="202.145.206.36"/>
    </slice>
    <from sec="1041397752" usec="0"/>
    <to sec="1041398044" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1006{
style=filled;
color=gray75;
3513[label="202.159.195.38;140pkt 140fpkt", shape=pentagon, color=darkviolet];
4512[label="202.159.195.38;139pkt 139fpkt", shape=invtriangle, color=brown];
stat1006[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.159.195.38:53, *:53}[22.1429%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (61.1111%)&lt;BR/&gt; 1024: (1.79211%)&lt;BR/&gt; 32774: (1.07527%)&lt;BR/&gt; 32772: (1.07527%)&lt;BR/&gt; 32770: (0.716846%)&gt;];
}
3513--4512[label="1;139pkt 139fpkt"];
</description>
    <slice>
      <filter dst_port="53" src_ip="202.159.195.38" src_port="53"/>
    </slice>
    <from sec="1041397225" usec="0"/>
    <to sec="1041398817" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="172.142.219.38"/>
    </slice>
    <from sec="1041397204" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.10917,1.9092,020,1 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1008{
style=filled;
color=gray75;
693[label="217.88.16.110d;37pkt 37fpkt", shape=rectangle, color=red];
2090[label="168.25.171.39;s;190pkt 190fpkt", shape=diamond, color=yellow];
3518[label="168.25.171.39;196pkt 196fpkt", shape=pentagon, color=darkviolet];
4518[label="168.25.171.39;195pkt 195fpkt", shape=invtriangle, color=brown];
5049[label="168.25.171.39;196pkt 196fpkt", shape=invhouse, color=bisque];
stat1008[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.25.171.39:0, *:0}[84.5494%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
693--2090[label="0.027027;1pkt 1fpkt"];
693--3518[label="0.027027;1pkt 1fpkt"];
693--4518[label="0.027027;1pkt 1fpkt"];
693--5049[label="0.027027;1pkt 1fpkt"];
2090--3518[label="0.994737;189pkt 189fpkt"];
2090--4518[label="0.989474;188pkt 188fpkt"];
2090--5049[label="0.994737;189pkt 189fpkt"];
3518--4518[label="1;195pkt 195fpkt"];
3518--5049[label="1;196pkt 196fpkt"];
4518--5049[label="1;195pkt 195fpkt"];
</description>
    <slice>
      <filter src_ip="168.25.171.39"/>
    </slice>
    <from sec="1041397203" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="90.107.31.40"/>
    </slice>
    <from sec="1041397203" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.958875,1.95391,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1010{
style=filled;
color=gray75;
3534[label="218.248.6.43;100pkt 100fpkt", shape=pentagon, color=darkviolet];
4527[label="218.248.6.43;100pkt 100fpkt", shape=invtriangle, color=brown];
5056[label="218.248.6.43;101pkt 101fpkt", shape=invhouse, color=bisque];
stat1010[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.248.6.43:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3534--4527[label="1;100pkt 100fpkt"];
3534--5056[label="1;100pkt 100fpkt"];
4527--5056[label="1;100pkt 100fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="218.248.6.43" src_port="1027"/>
    </slice>
    <from sec="1041397660" usec="0"/>
    <to sec="1041397678" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="209.29.131.44"/>
    </slice>
    <from sec="1041398239" usec="0"/>
    <to sec="1041398314" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="4.200.168.46"/>
    </slice>
    <from sec="1041397212" usec="0"/>
    <to sec="1041398815" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,020,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1013{
style=filled;
color=gray75;
3553[label="202.159.212.46;23pkt 23fpkt", shape=pentagon, color=darkviolet];
4534[label="202.159.212.46;22pkt 22fpkt", shape=invtriangle, color=brown];
stat1013[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.159.212.46:0, *:0}[65.2174%]&lt;BR/&gt;{202.159.212.46:53, *:*}[34.7826%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (64.4444%)&lt;BR/&gt; 53: (26.6667%)&lt;BR/&gt; 32768: (4.44444%)&lt;BR/&gt; 32770: (2.22222%)&lt;BR/&gt; 2029: (2.22222%)&gt;];
}
3553--4534[label="1;22pkt 22fpkt"];
</description>
    <slice>
      <filter src_ip="202.159.212.46" src_port="53"/>
      <filter src_ip="202.159.212.46"/>
    </slice>
    <from sec="1041397228" usec="0"/>
    <to sec="1041398760" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="219.171.157.48"/>
    </slice>
    <from sec="1041397204" usec="0"/>
    <to sec="1041398164" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1015{
style=filled;
color=gray75;
3560[label="203.224.176.48;117pkt 117fpkt", shape=pentagon, color=darkviolet];
4539[label="203.224.176.48;116pkt 116fpkt", shape=invtriangle, color=brown];
stat1015[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.224.176.48:62286, *:137}[28.2051%]&lt;BR/&gt;{203.224.176.48:62285, *:137}[26.4957%]&lt;BR/&gt;{203.224.176.48:62284, *:137}[24.7863%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 62286: (13.9485%)&lt;BR/&gt; 62285: (13.3047%)&lt;BR/&gt; 62284: (12.4464%)&lt;BR/&gt; 62287: (6.00858%)&gt;];
}
3560--4539[label="1;116pkt 116fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="203.224.176.48" src_port="62286"/>
      <filter dst_port="137" src_ip="203.224.176.48" src_port="62285"/>
      <filter dst_port="137" src_ip="203.224.176.48" src_port="62284"/>
    </slice>
    <from sec="1041397314" usec="0"/>
    <to sec="1041397349" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1016{
style=filled;
color=gray75;
3564[label="144.52.86.50;27pkt 27fpkt", shape=pentagon, color=darkviolet];
4543[label="144.52.86.50;26pkt 26fpkt", shape=invtriangle, color=brown];
stat1016[shape=component, label=&lt;Rules:&lt;BR/&gt;{144.52.86.50:*, 2.197.74.219:80}[37.037%]&lt;BR/&gt;{144.52.86.50:*, 2.197.74.136:80}[22.2222%]&lt;BR/&gt;{144.52.86.50:*, 63.13.16.145:80}[22.2222%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 49251: (1.88679%)&lt;BR/&gt; 49250: (1.88679%)&lt;BR/&gt; 49249: (1.88679%)&lt;BR/&gt; 49248: (1.88679%)&gt;];
}
3564--4543[label="1;26pkt 26fpkt"];
</description>
    <slice>
      <filter dst_ip="2.197.74.219" dst_port="80" src_ip="144.52.86.50"/>
      <filter dst_ip="63.13.16.145" dst_port="80" src_ip="144.52.86.50"/>
      <filter dst_ip="2.197.74.136" dst_port="80" src_ip="144.52.86.50"/>
    </slice>
    <from sec="1041397615" usec="0"/>
    <to sec="1041398154" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.958875,1.95391,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1017{
style=filled;
color=gray75;
3569[label="90.222.49.51;19pkt 19fpkt", shape=pentagon, color=darkviolet];
4546[label="90.222.49.51;19pkt 19fpkt", shape=invtriangle, color=brown];
5060[label="90.222.49.51;18pkt 18fpkt", shape=invhouse, color=bisque];
stat1017[shape=component, label=&lt;Rules:&lt;BR/&gt;{90.222.49.51:*, 172.142.72.13:25}[31.5789%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 39316: (2.67857%)&lt;BR/&gt; 39002: (2.67857%)&lt;BR/&gt; 38031: (2.67857%)&lt;BR/&gt; 37999: (2.67857%)&gt;];
}
3569--4546[label="1;19pkt 19fpkt"];
3569--5060[label="1;18pkt 18fpkt"];
4546--5060[label="1;18pkt 18fpkt"];
</description>
    <slice>
      <filter dst_ip="172.142.72.13" dst_port="25" src_ip="90.222.49.51"/>
    </slice>
    <from sec="1041397560" usec="0"/>
    <to sec="1041398821" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="90.72.0.52"/>
    </slice>
    <from sec="1041397562" usec="0"/>
    <to sec="1041398132" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.958875,1.95391,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1019{
style=filled;
color=gray75;
3579[label="216.241.109.53;105pkt 105fpkt", shape=pentagon, color=darkviolet];
4550[label="216.241.109.53;104pkt 104fpkt", shape=invtriangle, color=brown];
5062[label="216.241.109.53;104pkt 104fpkt", shape=invhouse, color=bisque];
stat1019[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.241.109.53:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3579--4550[label="1;104pkt 104fpkt"];
3579--5062[label="1;104pkt 104fpkt"];
4550--5062[label="1;104pkt 104fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="216.241.109.53" src_port="1028"/>
    </slice>
    <from sec="1041397360" usec="0"/>
    <to sec="1041397395" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="62.145.114.56"/>
    </slice>
    <from sec="1041397210" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="153.56.208.56"/>
    </slice>
    <from sec="1041397434" usec="0"/>
    <to sec="1041397438" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,002,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="10.10.40.59"/>
    </slice>
    <from sec="1041397236" usec="0"/>
    <to sec="1041398822" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.958875,1.95391,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1023{
style=filled;
color=gray75;
3599[label="148.42.108.60;37pkt 37fpkt", shape=pentagon, color=darkviolet];
4561[label="148.42.108.60;36pkt 36fpkt", shape=invtriangle, color=brown];
5071[label="148.42.108.60;36pkt 36fpkt", shape=invhouse, color=bisque];
stat1023[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.42.108.60:80, *:*}[48.6486%]&lt;BR/&gt;{148.42.108.60:53, *:*}[24.3243%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (23.8532%)&lt;BR/&gt; 53: (16.5138%)&lt;BR/&gt; 25: (8.25688%)&lt;BR/&gt; 113: (4.12844%)&lt;BR/&gt; 0: (2.75229%)&gt;];
}
3599--4561[label="1;36pkt 36fpkt"];
3599--5071[label="1;36pkt 36fpkt"];
4561--5071[label="1;36pkt 36fpkt"];
</description>
    <slice>
      <filter src_ip="148.42.108.60" src_port="80"/>
      <filter src_ip="148.42.108.60" src_port="53"/>
    </slice>
    <from sec="1041397260" usec="0"/>
    <to sec="1041398786" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.958875,1.95391,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1024{
style=filled;
color=gray75;
3608[label="218.92.35.63;15pkt 15fpkt", shape=pentagon, color=darkviolet];
4566[label="218.92.35.63;16pkt 16fpkt", shape=invtriangle, color=brown];
5076[label="218.92.35.63;16pkt 16fpkt", shape=invhouse, color=bisque];
stat1024[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.92.35.63:80, 148.155.168.167:*}[56.25%]&lt;BR/&gt;{218.92.35.63:80, 168.125.242.218:*}[43.75%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 62029: (3.19149%)&lt;BR/&gt; 62021: (3.19149%)&lt;BR/&gt; 62020: (3.19149%)&lt;BR/&gt; 62018: (3.19149%)&gt;];
}
3608--4566[label="1;15pkt 15fpkt"];
3608--5076[label="1;15pkt 15fpkt"];
4566--5076[label="1;16pkt 16fpkt"];
</description>
    <slice>
      <filter dst_ip="148.155.168.167" src_ip="218.92.35.63" src_port="80"/>
      <filter dst_ip="168.125.242.218" src_ip="218.92.35.63" src_port="80"/>
    </slice>
    <from sec="1041397282" usec="0"/>
    <to sec="1041398786" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="202.233.156.63"/>
    </slice>
    <from sec="1041397773" usec="0"/>
    <to sec="1041397841" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="144.52.45.64"/>
    </slice>
    <from sec="1041398716" usec="0"/>
    <to sec="1041398736" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.958875,1.95391,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1027{
style=filled;
color=gray75;
3620[label="203.198.117.64;185pkt 185fpkt", shape=pentagon, color=darkviolet];
4572[label="203.198.117.64;186pkt 186fpkt", shape=invtriangle, color=brown];
5077[label="203.198.117.64;186pkt 186fpkt", shape=invhouse, color=bisque];
stat1027[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.198.117.64:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3620--4572[label="1;185pkt 185fpkt"];
3620--5077[label="1;185pkt 185fpkt"];
4572--5077[label="1;186pkt 186fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="203.198.117.64" src_port="1027"/>
    </slice>
    <from sec="1041398381" usec="0"/>
    <to sec="1041398424" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1028{
style=filled;
color=gray75;
3632[label="193.41.88.67;211pkt 211fpkt", shape=pentagon, color=darkviolet];
4576[label="193.41.88.67;211pkt 211fpkt", shape=invtriangle, color=brown];
stat1028[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.41.88.67:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3632--4576[label="1;211pkt 211fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="193.41.88.67" src_port="1028"/>
    </slice>
    <from sec="1041397944" usec="0"/>
    <to sec="1041397977" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1029{
style=filled;
color=gray75;
3637[label="195.53.180.67;259pkt 259fpkt", shape=pentagon, color=darkviolet];
4578[label="195.53.180.67;258pkt 258fpkt", shape=invtriangle, color=brown];
stat1029[shape=component, label=&lt;Rules:&lt;BR/&gt;{195.53.180.67:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3637--4578[label="1;258pkt 258fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="195.53.180.67" src_port="1029"/>
    </slice>
    <from sec="1041397898" usec="0"/>
    <to sec="1041398170" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="197.182.0.69"/>
    </slice>
    <from sec="1041398202" usec="0"/>
    <to sec="1041398211" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1031{
style=filled;
color=gray75;
3666[label="136.234.61.74;40pkt 40fpkt", shape=pentagon, color=darkviolet];
4590[label="136.234.61.74;40pkt 40fpkt", shape=invtriangle, color=brown];
stat1031[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.61.74:*, 209.40.197.14:80}[35%]&lt;BR/&gt;{136.234.61.74:*, 88.177.39.125:80}[30%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1070: (1.25%)&lt;BR/&gt; 1069: (1.25%)&lt;BR/&gt; 1068: (1.25%)&lt;BR/&gt; 1067: (1.25%)&gt;];
}
3666--4590[label="1;40pkt 40fpkt"];
</description>
    <slice>
      <filter dst_ip="209.40.197.14" dst_port="80" src_ip="136.234.61.74"/>
      <filter dst_ip="88.177.39.125" dst_port="80" src_ip="136.234.61.74"/>
    </slice>
    <from sec="1041398435" usec="0"/>
    <to sec="1041398453" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.958875,1.95391,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1032{
style=filled;
color=gray75;
3676[label="4.71.163.76;102pkt 102fpkt", shape=pentagon, color=darkviolet];
4594[label="4.71.163.76;101pkt 101fpkt", shape=invtriangle, color=brown];
5089[label="4.71.163.76;102pkt 102fpkt", shape=invhouse, color=bisque];
stat1032[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.71.163.76:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3676--4594[label="1;101pkt 101fpkt"];
3676--5089[label="1;102pkt 102fpkt"];
4594--5089[label="1;101pkt 101fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="4.71.163.76" src_port="1026"/>
    </slice>
    <from sec="1041398220" usec="0"/>
    <to sec="1041398236" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1033{
style=filled;
color=gray75;
3685[label="202.46.93.79;120pkt 120fpkt", shape=pentagon, color=darkviolet];
4598[label="202.46.93.79;119pkt 119fpkt", shape=invtriangle, color=brown];
stat1033[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.46.93.79:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3685--4598[label="1;119pkt 119fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="202.46.93.79" src_port="1029"/>
    </slice>
    <from sec="1041398633" usec="0"/>
    <to sec="1041398668" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="194.10.9.80"/>
    </slice>
    <from sec="1041397254" usec="0"/>
    <to sec="1041398760" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.958875,1.95391,020,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1035{
style=filled;
color=gray75;
3705[label="192.40.128.83;134pkt 134fpkt", shape=pentagon, color=darkviolet];
4608[label="192.40.128.83;134pkt 134fpkt", shape=invtriangle, color=brown];
5096[label="192.40.128.83;135pkt 135fpkt", shape=invhouse, color=bisque];
stat1035[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.40.128.83:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
3705--4608[label="1;134pkt 134fpkt"];
3705--5096[label="1;134pkt 134fpkt"];
4608--5096[label="1;134pkt 134fpkt"];
</description>
    <slice>
      <filter src_ip="192.40.128.83"/>
    </slice>
    <from sec="1041397210" usec="0"/>
    <to sec="1041398817" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.958875,1.95391,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1036{
style=filled;
color=gray75;
3706[label="61.101.148.83;29pkt 29fpkt", shape=pentagon, color=darkviolet];
4609[label="61.101.148.83;29pkt 29fpkt", shape=invtriangle, color=brown];
5097[label="61.101.148.83;29pkt 29fpkt", shape=invhouse, color=bisque];
stat1036[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.101.148.83:*, 172.142.208.128:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1377: (1.72414%)&lt;BR/&gt; 1376: (1.72414%)&lt;BR/&gt; 1375: (1.72414%)&lt;BR/&gt; 1374: (1.72414%)&gt;];
}
3706--4609[label="1;29pkt 29fpkt"];
3706--5097[label="1;29pkt 29fpkt"];
4609--5097[label="1;29pkt 29fpkt"];
</description>
    <slice>
      <filter dst_ip="172.142.208.128" dst_port="80" src_ip="61.101.148.83"/>
    </slice>
    <from sec="1041397692" usec="0"/>
    <to sec="1041397880" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.873736,1.91329,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1037{
style=filled;
color=gray75;
2100[label="172.142.193.83;s;166pkt 166fpkt", shape=diamond, color=yellow];
2481[label="4.44.149.66;d;35pkt 35fpkt", shape=diamond, color=yellow];
3707[label="172.142.193.83;169pkt 169fpkt", shape=pentagon, color=darkviolet];
4610[label="172.142.193.83;169pkt 169fpkt", shape=invtriangle, color=brown];
stat1037[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.142.193.83:80, 90.14.20.156:*}[28.2353%]&lt;BR/&gt;{172.142.193.83:80, 4.44.149.66:*}[21.7647%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1450: (0.649351%)&lt;BR/&gt; 1458: (0.371058%)&lt;BR/&gt; 1457: (0.371058%)&lt;BR/&gt; 1456: (0.371058%)&gt;];
}
2100--2481[label="1;35pkt 35fpkt"];
2100--2582[label="0.959184;47pkt 47fpkt"];
2100--3707[label="0.993976;165pkt 165fpkt"];
2100--4610[label="0.993976;165pkt 165fpkt"];
2481--3707[label="1;35pkt 35fpkt"];
2481--4610[label="1;35pkt 35fpkt"];
3707--4610[label="1;169pkt 169fpkt"];
</description>
    <slice>
      <filter dst_ip="90.14.20.156" src_ip="172.142.193.83" src_port="80"/>
      <filter dst_ip="4.44.149.66" src_ip="172.142.193.83" src_port="80"/>
    </slice>
    <from sec="1041397206" usec="0"/>
    <to sec="1041398821" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="90.8.197.87"/>
    </slice>
    <from sec="1041397495" usec="0"/>
    <to sec="1041397628" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.958875,1.95391,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1039{
style=filled;
color=gray75;
3725[label="203.59.19.88;16pkt 16fpkt", shape=pentagon, color=darkviolet];
4620[label="203.59.19.88;17pkt 17fpkt", shape=invtriangle, color=brown];
5104[label="203.59.19.88;16pkt 16fpkt", shape=invhouse, color=bisque];
stat1039[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.59.19.88:80, 203.117.2.58:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3547: (3.06122%)&lt;BR/&gt; 3532: (3.06122%)&lt;BR/&gt; 3516: (3.06122%)&lt;BR/&gt; 3501: (3.06122%)&gt;];
}
3725--4620[label="1;16pkt 16fpkt"];
3725--5104[label="1;16pkt 16fpkt"];
4620--5104[label="1;16pkt 16fpkt"];
</description>
    <slice>
      <filter dst_ip="203.117.2.58" src_ip="203.59.19.88" src_port="80"/>
    </slice>
    <from sec="1041398246" usec="0"/>
    <to sec="1041398267" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1040{
style=filled;
color=gray75;
623[label="61.241.69.89s;171pkt 171fpkt", shape=rectangle, color=red];
1178[label="61.241.69.89s;84pkt 84fpkt", shape=ellipse, color=green];
1580[label="61.241.69.89s;84pkt 84fpkt", shape=triangle, color=blue];
3730[label="61.241.69.89;169pkt 169fpkt", shape=pentagon, color=darkviolet];
4623[label="61.241.69.89;169pkt 169fpkt", shape=invtriangle, color=brown];
stat1040[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.241.69.89:*, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 65058: (0.369276%)&lt;BR/&gt; 65048: (0.369276%)&lt;BR/&gt; 64535: (0.369276%)&lt;BR/&gt; 64491: (0.369276%)&gt;];
}
623--1178[label="1;84pkt 84fpkt"];
623--1580[label="1;84pkt 84fpkt"];
623--3730[label="1;169pkt 169fpkt"];
623--4623[label="1;169pkt 169fpkt"];
1178--1580[label="1;84pkt 84fpkt"];
1178--3730[label="0.988095;83pkt 83fpkt"];
1178--4623[label="0.988095;83pkt 83fpkt"];
1580--3730[label="0.988095;83pkt 83fpkt"];
1580--4623[label="0.988095;83pkt 83fpkt"];
3730--4623[label="1;169pkt 169fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.241.69.89"/>
    </slice>
    <from sec="1041398235" usec="0"/>
    <to sec="1041398262" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="211.47.98.92"/>
    </slice>
    <from sec="1041397203" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="90.3.82.96"/>
    </slice>
    <from sec="1041397211" usec="0"/>
    <to sec="1041398812" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="4.204.249.97"/>
    </slice>
    <from sec="1041397236" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1044{
style=filled;
color=gray75;
3771[label="196.90.12.100;222pkt 222fpkt", shape=pentagon, color=darkviolet];
4644[label="196.90.12.100;222pkt 222fpkt", shape=invtriangle, color=brown];
stat1044[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.90.12.100:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3771--4644[label="1;222pkt 222fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="196.90.12.100" src_port="1029"/>
    </slice>
    <from sec="1041397710" usec="0"/>
    <to sec="1041397747" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="205.65.236.100"/>
    </slice>
    <from sec="1041397488" usec="0"/>
    <to sec="1041397498" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="217.5.78.104"/>
    </slice>
    <from sec="1041397203" usec="0"/>
    <to sec="1041397313" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.958875,1.95391,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1047{
style=filled;
color=gray75;
3825[label="202.159.238.112;128pkt 128fpkt", shape=pentagon, color=darkviolet];
4673[label="202.159.238.112;128pkt 128fpkt", shape=invtriangle, color=brown];
5129[label="202.159.238.112;128pkt 128fpkt", shape=invhouse, color=bisque];
stat1047[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.159.238.112:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 65348: (0.390625%)&lt;BR/&gt; 65345: (0.390625%)&lt;BR/&gt; 65326: (0.390625%)&lt;BR/&gt; 65223: (0.390625%)&gt;];
}
3825--4673[label="1;128pkt 128fpkt"];
3825--5129[label="1;128pkt 128fpkt"];
4673--5129[label="1;128pkt 128fpkt"];
</description>
    <slice>
      <filter src_ip="202.159.238.112" src_port="80"/>
    </slice>
    <from sec="1041397249" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.958875,1.95391,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1048{
style=filled;
color=gray75;
3830[label="217.89.143.113;150pkt 150fpkt", shape=pentagon, color=darkviolet];
4676[label="217.89.143.113;149pkt 149fpkt", shape=invtriangle, color=brown];
5132[label="217.89.143.113;149pkt 149fpkt", shape=invhouse, color=bisque];
stat1048[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.89.143.113:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3830--4676[label="1;149pkt 149fpkt"];
3830--5132[label="1;149pkt 149fpkt"];
4676--5132[label="1;149pkt 149fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.89.143.113" src_port="1027"/>
    </slice>
    <from sec="1041397686" usec="0"/>
    <to sec="1041397710" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.958875,1.95391,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1049{
style=filled;
color=gray75;
3843[label="217.32.60.115;243pkt 243fpkt", shape=pentagon, color=darkviolet];
4687[label="217.32.60.115;242pkt 242fpkt", shape=invtriangle, color=brown];
5138[label="217.32.60.115;243pkt 243fpkt", shape=invhouse, color=bisque];
stat1049[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.32.60.115:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3843--4687[label="1;242pkt 242fpkt"];
3843--5138[label="1;243pkt 243fpkt"];
4687--5138[label="1;242pkt 242fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.32.60.115" src_port="1025"/>
    </slice>
    <from sec="1041397259" usec="0"/>
    <to sec="1041397299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.873736,1.91329,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1050{
style=filled;
color=gray75;
2719[label="2.8.136.200;d;2pkt 2fpkt", shape=diamond, color=yellow];
3845[label="148.42.110.115;34pkt 34fpkt", shape=pentagon, color=darkviolet];
4689[label="148.42.110.115;34pkt 34fpkt", shape=invtriangle, color=brown];
stat1050[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.42.110.115:*, *:25}[80%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (41.4286%)&lt;BR/&gt; 0: (8.57143%)&lt;BR/&gt; 113: (4.28571%)&lt;BR/&gt; 57781: (2.14286%)&lt;BR/&gt; 58315: (1.42857%)&gt;];
}
2719--3845[label="0.5;1pkt 1fpkt"];
2719--4689[label="0.5;1pkt 1fpkt"];
3845--4689[label="1;34pkt 34fpkt"];
</description>
    <slice>
      <filter dst_port="25" src_ip="148.42.110.115"/>
    </slice>
    <from sec="1041397245" usec="0"/>
    <to sec="1041398700" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="205.65.22.119"/>
    </slice>
    <from sec="1041397215" usec="0"/>
    <to sec="1041398804" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="4.80.24.120"/>
    </slice>
    <from sec="1041397652" usec="0"/>
    <to sec="1041398344" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891309,1.82084,002,1 1 1 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1053{
style=filled;
color=gray75;
343[label="196.72.135.123s;177pkt 177fpkt", shape=rectangle, color=red];
961[label="196.72.135.123s;177pkt 177fpkt", shape=ellipse, color=green];
1426[label="196.72.135.123s;177pkt 177fpkt", shape=triangle, color=blue];
3877[label="196.72.135.123;212pkt 212fpkt", shape=pentagon, color=darkviolet];
4704[label="196.72.135.123;212pkt 212fpkt", shape=invtriangle, color=brown];
stat1053[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.72.135.123:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
343--961[label="1;177pkt 177fpkt"];
343--1426[label="1;177pkt 177fpkt"];
343--3877[label="1;177pkt 177fpkt"];
343--4704[label="1;177pkt 177fpkt"];
961--1426[label="1;177pkt 177fpkt"];
961--3877[label="1;177pkt 177fpkt"];
961--4704[label="1;177pkt 177fpkt"];
1426--3877[label="1;177pkt 177fpkt"];
1426--4704[label="1;177pkt 177fpkt"];
3877--4704[label="1;212pkt 212fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="196.72.135.123" src_port="1028"/>
    </slice>
    <from sec="1041397793" usec="0"/>
    <to sec="1041397829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1054{
style=filled;
color=gray75;
3880[label="136.234.117.124;6pkt 6fpkt", shape=pentagon, color=darkviolet];
4707[label="136.234.117.124;6pkt 6fpkt", shape=invtriangle, color=brown];
stat1054[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.117.124:*, 203.0.99.161:80}[33.3333%]&lt;BR/&gt;{136.234.117.124:*, 205.138.172.237:80}[33.3333%]&lt;BR/&gt;{136.234.117.124:49153, *:*}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (41.6667%)&lt;BR/&gt; 49153: (16.6667%)&lt;BR/&gt; 49159: (8.33333%)&lt;BR/&gt; 49157: (8.33333%)&lt;BR/&gt; 49156: (8.33333%)&gt;];
}
3880--4707[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter src_ip="136.234.117.124" src_port="49153"/>
      <filter dst_ip="205.138.172.237" dst_port="80" src_ip="136.234.117.124"/>
      <filter dst_ip="203.0.99.161" dst_port="80" src_ip="136.234.117.124"/>
    </slice>
    <from sec="1041398206" usec="0"/>
    <to sec="1041398435" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.958875,1.95391,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1055{
style=filled;
color=gray75;
3881[label="89.172.18.125;4pkt 4fpkt", shape=pentagon, color=darkviolet];
4708[label="89.172.18.125;4pkt 4fpkt", shape=invtriangle, color=brown];
5150[label="89.172.18.125;3pkt 3fpkt", shape=invhouse, color=bisque];
stat1055[shape=component, label=&lt;Rules:&lt;BR/&gt;{89.172.18.125:0, 202.159.193.16:80}[25%]&lt;BR/&gt;{89.172.18.125:0, 202.159.193.16:1080}[25%]&lt;BR/&gt;{89.172.18.125:0, 202.159.193.16:3128}[25%]&lt;BR/&gt;{89.172.18.125:0, 202.159.193.16:8080}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (50%)&lt;BR/&gt; 8080: (13.6364%)&lt;BR/&gt; 1080: (13.6364%)&lt;BR/&gt; 80: (13.6364%)&lt;BR/&gt; 3128: (9.09091%)&gt;];
}
3881--4708[label="1;4pkt 4fpkt"];
3881--5150[label="1;3pkt 3fpkt"];
4708--5150[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="202.159.193.16" dst_port="8080" src_ip="89.172.18.125"/>
      <filter dst_ip="202.159.193.16" dst_port="3128" src_ip="89.172.18.125"/>
      <filter dst_ip="202.159.193.16" dst_port="1080" src_ip="89.172.18.125"/>
      <filter dst_ip="202.159.193.16" dst_port="80" src_ip="89.172.18.125"/>
    </slice>
    <from sec="1041397713" usec="0"/>
    <to sec="1041397714" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1056{
style=filled;
color=gray75;
3902[label="150.167.224.128;6pkt 6fpkt", shape=pentagon, color=darkviolet];
4721[label="150.167.224.128;5pkt 5fpkt", shape=invtriangle, color=brown];
stat1056[shape=component, label=&lt;Rules:&lt;BR/&gt;{150.167.224.128:7001, *:7000}[50%]&lt;BR/&gt;{150.167.224.128:7001, *:7003}[50%]&lt;BR/&gt;{150.167.224.128:7001, 144.52.23.84:*}[33.3333%]&lt;BR/&gt;{150.167.224.128:7001, 144.52.64.84:*}[33.3333%]&lt;BR/&gt;{150.167.224.128:7001, 144.52.35.197:*}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 7001: (50%)&lt;BR/&gt; 7003: (27.2727%)&lt;BR/&gt; 7000: (22.7273%)&gt;];
}
3902--4721[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="144.52.35.197" src_ip="150.167.224.128" src_port="7001"/>
      <filter dst_ip="144.52.64.84" src_ip="150.167.224.128" src_port="7001"/>
      <filter dst_ip="144.52.23.84" src_ip="150.167.224.128" src_port="7001"/>
      <filter dst_port="7003" src_ip="150.167.224.128" src_port="7001"/>
      <filter dst_port="7000" src_ip="150.167.224.128" src_port="7001"/>
    </slice>
    <from sec="1041397316" usec="0"/>
    <to sec="1041398603" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="218.31.108.129"/>
    </slice>
    <from sec="1041398258" usec="0"/>
    <to sec="1041398304" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1058{
style=filled;
color=gray75;
3910[label="62.180.218.129;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4726[label="62.180.218.129;1pkt 1fpkt", shape=invtriangle, color=brown];
stat1058[shape=component, label=&lt;Rules:&lt;BR/&gt;{62.180.218.129:4662, 202.159.194.17:4568}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4662: (50%)&lt;BR/&gt; 4568: (50%)&gt;];
}
3910--4726[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="202.159.194.17" dst_port="4568" src_ip="62.180.218.129" src_port="4662"/>
    </slice>
    <from sec="1041397490" usec="0"/>
    <to sec="1041398799" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="88.106.10.131"/>
    </slice>
    <from sec="1041397207" usec="0"/>
    <to sec="1041398535" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="62.122.10.131"/>
    </slice>
    <from sec="1041398701" usec="0"/>
    <to sec="1041398747" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="218.22.183.131"/>
    </slice>
    <from sec="1041397209" usec="0"/>
    <to sec="1041398820" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1062{
style=filled;
color=gray75;
3947[label="207.48.138.136;43pkt 43fpkt", shape=pentagon, color=darkviolet];
4749[label="207.48.138.136;43pkt 43fpkt", shape=invtriangle, color=brown];
stat1062[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.48.138.136:80, 202.159.192.25:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 29953: (1.16279%)&lt;BR/&gt; 29916: (1.16279%)&lt;BR/&gt; 29847: (1.16279%)&lt;BR/&gt; 29825: (1.16279%)&gt;];
}
3947--4749[label="1;43pkt 43fpkt"];
</description>
    <slice>
      <filter dst_ip="202.159.192.25" src_ip="207.48.138.136" src_port="80"/>
    </slice>
    <from sec="1041397286" usec="0"/>
    <to sec="1041398499" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.12182,1.93656,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1063{
style=filled;
color=gray75;
2142[label="172.142.201.138;s;76pkt 76fpkt", shape=diamond, color=yellow];
2230[label="88.212.112.133;d;36pkt 36fpkt", shape=diamond, color=yellow];
2467[label="148.132.163.246;s;132pkt 132fpkt", shape=diamond, color=yellow];
2629[label="144.52.42.80;s;69pkt 69fpkt", shape=diamond, color=yellow];
2857[label="203.59.22.160;s;205pkt 205fpkt", shape=hexagon, color=black];
2930[label="148.132.163.244;s;261pkt 261fpkt", shape=hexagon, color=black];
3684[label="168.125.188.78;22pkt 22fpkt", shape=pentagon, color=darkviolet];
3938[label="144.52.246.133;12pkt 12fpkt", shape=pentagon, color=darkviolet];
4444[label="148.4.130.11;1pkt 1fpkt", shape=invtriangle, color=brown];
4751[label="148.155.152.136;33pkt 33fpkt", shape=invtriangle, color=brown];
4758[label="172.142.201.138;76pkt 76fpkt", shape=invtriangle, color=brown];
stat1063[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.59.22.160:80, *:*}[22.1027%]&lt;BR/&gt;{148.132.163.244:1289, *:53}[21.5054%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (22.3727%)&lt;BR/&gt; 0: (20.0433%)&lt;BR/&gt; 80: (17.4973%)&lt;BR/&gt; 1289: (9.75081%)&lt;BR/&gt; 1816: (3.08776%)&gt;];
}
2142--2230[label="0.0277778;1pkt 1fpkt"];
2142--4758[label="0.986842;75pkt 75fpkt"];
2230--2467[label="0.0277778;1pkt 1fpkt"];
2230--2629[label="0.0277778;1pkt 1fpkt"];
2230--2795[label="0.138889;5pkt 5fpkt"];
2230--2857[label="0.0277778;1pkt 1fpkt"];
2230--2930[label="0.0555556;2pkt 2fpkt"];
2230--3684[label="0.0909091;2pkt 2fpkt"];
2230--3938[label="0.0833333;1pkt 1fpkt"];
2230--4265[label="0.0277778;1pkt 1fpkt"];
2230--4444[label="1;1pkt 1fpkt"];
2230--4751[label="0.030303;1pkt 1fpkt"];
2230--4758[label="0.0277778;1pkt 1fpkt"];
2230--4922[label="0.0277778;1pkt 1fpkt"];
2230--5246[label="0.0277778;1pkt 1fpkt"];
2467--3156[label="0.00757576;1pkt 1fpkt"];
2467--3273[label="0.00757576;1pkt 1fpkt"];
2467--3274[label="0.0833333;11pkt 11fpkt"];
2467--3278[label="0.0984848;13pkt 13fpkt"];
2467--3282[label="0.0606061;8pkt 8fpkt"];
2467--3288[label="0.0833333;11pkt 11fpkt"];
2467--3293[label="0.0984848;13pkt 13fpkt"];
2467--3296[label="0.0606061;8pkt 8fpkt"];
2467--3297[label="0.0833333;11pkt 11fpkt"];
2629--3060[label="0.027027;1pkt 1fpkt"];
2857--3060[label="0.108108;4pkt 4fpkt"];
2857--3156[label="0.392857;66pkt 66fpkt"];
2857--3273[label="0.392857;66pkt 66fpkt"];
2930--3274[label="0.0727969;19pkt 19fpkt"];
2930--3278[label="0.103448;27pkt 27fpkt"];
2930--3282[label="0.0727969;19pkt 19fpkt"];
2930--3288[label="0.0727969;19pkt 19fpkt"];
2930--3293[label="0.103448;27pkt 27fpkt"];
2930--3296[label="0.0727969;19pkt 19fpkt"];
2930--3297[label="0.0727969;19pkt 19fpkt"];
</description>
    <slice>
      <filter src_ip="203.59.22.160" src_port="80"/>
      <filter dst_port="53" src_ip="148.132.163.244" src_port="1289"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398792" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="145.228.132.137"/>
    </slice>
    <from sec="1041397276" usec="0"/>
    <to sec="1041397283" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1065{
style=filled;
color=gray75;
3956[label="90.160.200.137;125pkt 125fpkt", shape=pentagon, color=darkviolet];
4754[label="90.160.200.137;124pkt 124fpkt", shape=invtriangle, color=brown];
stat1065[shape=component, label=&lt;Rules:&lt;BR/&gt;{90.160.200.137:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3956--4754[label="1;124pkt 124fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="90.160.200.137" src_port="1026"/>
    </slice>
    <from sec="1041398435" usec="0"/>
    <to sec="1041398454" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.958875,1.95391,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1066{
style=filled;
color=gray75;
3959[label="61.226.36.138;230pkt 230fpkt", shape=pentagon, color=darkviolet];
4756[label="61.226.36.138;230pkt 230fpkt", shape=invtriangle, color=brown];
5172[label="61.226.36.138;230pkt 230fpkt", shape=invhouse, color=bisque];
stat1066[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.226.36.138:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3959--4756[label="1;230pkt 230fpkt"];
3959--5172[label="1;230pkt 230fpkt"];
4756--5172[label="1;230pkt 230fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="61.226.36.138" src_port="1026"/>
    </slice>
    <from sec="1041397459" usec="0"/>
    <to sec="1041397496" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,502,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="216.204.10.139"/>
    </slice>
    <from sec="1041397201" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="90.42.154.141"/>
    </slice>
    <from sec="1041397225" usec="0"/>
    <to sec="1041398796" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,501,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="213.22.112.145"/>
    </slice>
    <from sec="1041397213" usec="0"/>
    <to sec="1041397517" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.958875,1.95391,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1070{
style=filled;
color=gray75;
4001[label="210.226.80.147;138pkt 138fpkt", shape=pentagon, color=darkviolet];
4775[label="210.226.80.147;138pkt 138fpkt", shape=invtriangle, color=brown];
5178[label="210.226.80.147;138pkt 138fpkt", shape=invhouse, color=bisque];
stat1070[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.226.80.147:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
4001--4775[label="1;138pkt 138fpkt"];
4001--5178[label="1;138pkt 138fpkt"];
4775--5178[label="1;138pkt 138fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="210.226.80.147" src_port="1028"/>
    </slice>
    <from sec="1041398422" usec="0"/>
    <to sec="1041398449" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="144.52.218.147"/>
    </slice>
    <from sec="1041397206" usec="0"/>
    <to sec="1041398822" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.10027,1.95018,010,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1072{
style=filled;
color=gray75;
2478[label="203.59.17.149;s;95pkt 95fpkt", shape=diamond, color=yellow];
4009[label="203.59.17.149;104pkt 104fpkt", shape=pentagon, color=darkviolet];
4778[label="203.59.17.149;103pkt 103fpkt", shape=invtriangle, color=brown];
5179[label="203.59.17.149;103pkt 103fpkt", shape=invhouse, color=bisque];
stat1072[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.59.17.149:*, *:80}[36.5385%]&lt;BR/&gt;{203.59.17.149:*, *:21}[21.1538%]&lt;BR/&gt;{203.59.17.149:*, 192.168.1.2:*}[20.1923%]&lt;BR/&gt;{203.59.17.149:*, 192.168.1.3:*}[20.1923%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (18.2716%)&lt;BR/&gt; 0: (14.321%)&lt;BR/&gt; 21: (10.6173%)&lt;BR/&gt; 25: (8.64198%)&lt;BR/&gt; 110: (5.30864%)&gt;];
}
2478--3279[label="0.0421053;4pkt 4fpkt"];
2478--3294[label="0.0421053;4pkt 4fpkt"];
2478--4009[label="1;95pkt 95fpkt"];
2478--4778[label="0.989474;94pkt 94fpkt"];
2478--5179[label="0.989474;94pkt 94fpkt"];
4009--4778[label="1;103pkt 103fpkt"];
4009--5179[label="1;103pkt 103fpkt"];
4778--5179[label="1;103pkt 103fpkt"];
</description>
    <slice>
      <filter dst_ip="192.168.1.3" src_ip="203.59.17.149"/>
      <filter dst_ip="192.168.1.2" src_ip="203.59.17.149"/>
      <filter dst_port="80" src_ip="203.59.17.149"/>
      <filter dst_port="21" src_ip="203.59.17.149"/>
    </slice>
    <from sec="1041397208" usec="0"/>
    <to sec="1041398804" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.770694,1.8419,002,1 1 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1073{
style=filled;
color=gray75;
414[label="203.54.236.149s;226pkt 226fpkt", shape=rectangle, color=red];
1015[label="203.54.236.149s;109pkt 109fpkt", shape=ellipse, color=green];
4011[label="203.54.236.149;231pkt 231fpkt", shape=pentagon, color=darkviolet];
4779[label="203.54.236.149;230pkt 230fpkt", shape=invtriangle, color=brown];
stat1073[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.54.236.149:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
414--1015[label="1;109pkt 109fpkt"];
414--4011[label="1;226pkt 226fpkt"];
414--4779[label="0.995575;225pkt 225fpkt"];
1015--4011[label="1;109pkt 109fpkt"];
1015--4779[label="1;109pkt 109fpkt"];
4011--4779[label="1;230pkt 230fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="203.54.236.149" src_port="1027"/>
    </slice>
    <from sec="1041397841" usec="0"/>
    <to sec="1041397887" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.969076,1.91301,002,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1074{
style=filled;
color=gray75;
415[label="211.232.2.150s;211pkt 211fpkt", shape=rectangle, color=red];
4012[label="211.232.2.150;210pkt 210fpkt", shape=pentagon, color=darkviolet];
4780[label="211.232.2.150;209pkt 209fpkt", shape=invtriangle, color=brown];
5180[label="211.232.2.150;209pkt 209fpkt", shape=invhouse, color=bisque];
stat1074[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.232.2.150:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
415--4012[label="1;210pkt 210fpkt"];
415--4780[label="1;209pkt 209fpkt"];
415--5180[label="1;209pkt 209fpkt"];
4012--4780[label="1;209pkt 209fpkt"];
4012--5180[label="1;209pkt 209fpkt"];
4780--5180[label="1;209pkt 209fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="211.232.2.150" src_port="1027"/>
    </slice>
    <from sec="1041398206" usec="0"/>
    <to sec="1041398251" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.10027,1.95018,020,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1075{
style=filled;
color=gray75;
2197[label="203.59.20.151;s;51pkt 51fpkt", shape=diamond, color=yellow];
4017[label="203.59.20.151;51pkt 51fpkt", shape=pentagon, color=darkviolet];
4783[label="203.59.20.151;50pkt 50fpkt", shape=invtriangle, color=brown];
5183[label="203.59.20.151;50pkt 50fpkt", shape=invhouse, color=bisque];
stat1075[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.59.20.151:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
2197--4017[label="1;51pkt 51fpkt"];
2197--4783[label="1;50pkt 50fpkt"];
2197--5183[label="1;50pkt 50fpkt"];
4017--4783[label="1;50pkt 50fpkt"];
4017--5183[label="1;50pkt 50fpkt"];
4783--5183[label="1;50pkt 50fpkt"];
</description>
    <slice>
      <filter src_ip="203.59.20.151"/>
    </slice>
    <from sec="1041397204" usec="0"/>
    <to sec="1041398821" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,501,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1076{
style=filled;
color=gray75;
4019[label="148.4.132.151;6pkt 6fpkt", shape=pentagon, color=darkviolet];
4784[label="148.4.132.151;6pkt 6fpkt", shape=invtriangle, color=brown];
stat1076[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.4.132.151:21, 213.22.102.202:*}[66.6667%]&lt;BR/&gt;{148.4.132.151:80, *:*}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (33.3333%)&lt;BR/&gt; 80: (16.6667%)&lt;BR/&gt; 41991: (8.33333%)&lt;BR/&gt; 3142: (8.33333%)&lt;BR/&gt; 2384: (8.33333%)&gt;];
}
4019--4784[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter src_ip="148.4.132.151" src_port="80"/>
      <filter dst_ip="213.22.102.202" src_ip="148.4.132.151" src_port="21"/>
    </slice>
    <from sec="1041397241" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.958875,1.95391,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1077{
style=filled;
color=gray75;
4022[label="211.58.5.152;5pkt 5fpkt", shape=pentagon, color=darkviolet];
4785[label="211.58.5.152;4pkt 4fpkt", shape=invtriangle, color=brown];
5184[label="211.58.5.152;4pkt 4fpkt", shape=invhouse, color=bisque];
stat1077[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.58.5.152:44459, 148.42.108.60:80}[20%]&lt;BR/&gt;{211.58.5.152:44518, 148.42.108.60:80}[20%]&lt;BR/&gt;{211.58.5.152:50864, 148.42.108.60:80}[20%]&lt;BR/&gt;{211.58.5.152:50964, 148.42.108.60:80}[20%]&lt;BR/&gt;{211.58.5.152:51613, 148.42.108.60:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 51613: (11.5385%)&lt;BR/&gt; 50964: (11.5385%)&lt;BR/&gt; 50864: (11.5385%)&lt;BR/&gt; 44518: (11.5385%)&gt;];
}
4022--4785[label="1;4pkt 4fpkt"];
4022--5184[label="1;4pkt 4fpkt"];
4785--5184[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="148.42.108.60" dst_port="80" src_ip="211.58.5.152" src_port="51613"/>
      <filter dst_ip="148.42.108.60" dst_port="80" src_ip="211.58.5.152" src_port="50964"/>
      <filter dst_ip="148.42.108.60" dst_port="80" src_ip="211.58.5.152" src_port="50864"/>
      <filter dst_ip="148.42.108.60" dst_port="80" src_ip="211.58.5.152" src_port="44518"/>
      <filter dst_ip="148.42.108.60" dst_port="80" src_ip="211.58.5.152" src_port="44459"/>
    </slice>
    <from sec="1041398006" usec="0"/>
    <to sec="1041398034" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.958875,1.95391,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1078{
style=filled;
color=gray75;
4027[label="172.142.195.153;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4788[label="172.142.195.153;1pkt 1fpkt", shape=invtriangle, color=brown];
5185[label="172.142.195.153;1pkt 1fpkt", shape=invhouse, color=bisque];
stat1078[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.142.195.153:80, 203.198.146.30:1927}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1927: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
4027--4788[label="1;1pkt 1fpkt"];
4027--5185[label="1;1pkt 1fpkt"];
4788--5185[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="203.198.146.30" dst_port="1927" src_ip="172.142.195.153" src_port="80"/>
    </slice>
    <from sec="1041397301" usec="0"/>
    <to sec="1041397354" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1079{
style=filled;
color=gray75;
4030[label="192.59.27.154;32pkt 32fpkt", shape=pentagon, color=darkviolet];
4791[label="192.59.27.154;32pkt 32fpkt", shape=invtriangle, color=brown];
stat1079[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.59.27.154:80, 217.50.2.80:*}[50%]&lt;BR/&gt;{192.59.27.154:80, 217.92.179.147:*}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4406: (1.5625%)&lt;BR/&gt; 4397: (1.5625%)&lt;BR/&gt; 4384: (1.5625%)&lt;BR/&gt; 4366: (1.5625%)&gt;];
}
4030--4791[label="1;32pkt 32fpkt"];
</description>
    <slice>
      <filter dst_ip="217.92.179.147" src_ip="192.59.27.154" src_port="80"/>
      <filter dst_ip="217.50.2.80" src_ip="192.59.27.154" src_port="80"/>
    </slice>
    <from sec="1041398521" usec="0"/>
    <to sec="1041398602" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,020,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1080{
style=filled;
color=gray75;
4044[label="203.59.20.157;26pkt 26fpkt", shape=pentagon, color=darkviolet];
4799[label="203.59.20.157;25pkt 25fpkt", shape=invtriangle, color=brown];
stat1080[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.59.20.157:0, *:0}[46.1538%]&lt;BR/&gt;{203.59.20.157:*, *:113}[26.9231%]&lt;BR/&gt;{203.59.20.157:25, *:*}[26.9231%]&lt;BR/&gt;{203.59.20.157:*, 192.211.36.87:*}[23.0769%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (47.0588%)&lt;BR/&gt; 113: (13.7255%)&lt;BR/&gt; 25: (12.7451%)&lt;BR/&gt; 63757: (1.96078%)&lt;BR/&gt; 63755: (1.96078%)&gt;];
}
4044--4799[label="1;25pkt 25fpkt"];
</description>
    <slice>
      <filter dst_ip="192.211.36.87" src_ip="203.59.20.157"/>
      <filter src_ip="203.59.20.157" src_port="25"/>
      <filter dst_port="113" src_ip="203.59.20.157"/>
      <filter src_ip="203.59.20.157"/>
    </slice>
    <from sec="1041397217" usec="0"/>
    <to sec="1041398579" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1081{
style=filled;
color=gray75;
4058[label="172.142.195.159;12pkt 12fpkt", shape=pentagon, color=darkviolet];
4807[label="172.142.195.159;11pkt 11fpkt", shape=invtriangle, color=brown];
stat1081[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.142.195.159:25, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 53313: (4.34783%)&lt;BR/&gt; 43931: (4.34783%)&lt;BR/&gt; 40379: (4.34783%)&lt;BR/&gt; 40292: (4.34783%)&gt;];
}
4058--4807[label="1;11pkt 11fpkt"];
</description>
    <slice>
      <filter src_ip="172.142.195.159" src_port="25"/>
    </slice>
    <from sec="1041397263" usec="0"/>
    <to sec="1041398646" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,504,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1082{
style=filled;
color=gray75;
4059[label="89.16.244.159;14pkt 14fpkt", shape=pentagon, color=darkviolet];
4808[label="89.16.244.159;14pkt 14fpkt", shape=invtriangle, color=brown];
stat1082[shape=component, label=&lt;Rules:&lt;BR/&gt;{89.16.244.159:80, *:*}[64.2857%]&lt;BR/&gt;{89.16.244.159:443, *:*}[35.7143%]&lt;BR/&gt;{89.16.244.159:*, 148.155.246.87:*}[21.4286%]&lt;BR/&gt;{89.16.244.159:*, 148.155.39.102:*}[21.4286%]&lt;BR/&gt;{89.16.244.159:*, 148.155.57.142:*}[21.4286%]&lt;BR/&gt;{89.16.244.159:*, 148.155.39.177:*}[21.4286%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (32.1429%)&lt;BR/&gt; 443: (17.8571%)&lt;BR/&gt; 4614: (3.57143%)&lt;BR/&gt; 4611: (3.57143%)&lt;BR/&gt; 4610: (3.57143%)&gt;];
}
4059--4808[label="1;14pkt 14fpkt"];
</description>
    <slice>
      <filter dst_ip="148.155.39.177" src_ip="89.16.244.159"/>
      <filter dst_ip="148.155.57.142" src_ip="89.16.244.159"/>
      <filter dst_ip="148.155.39.102" src_ip="89.16.244.159"/>
      <filter dst_ip="148.155.246.87" src_ip="89.16.244.159"/>
      <filter src_ip="89.16.244.159" src_port="80"/>
      <filter src_ip="89.16.244.159" src_port="443"/>
    </slice>
    <from sec="1041397974" usec="0"/>
    <to sec="1041398355" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1083{
style=filled;
color=gray75;
445[label="89.113.128.161s;153pkt 153fpkt", shape=rectangle, color=red];
1041[label="89.113.128.161s;115pkt 115fpkt", shape=ellipse, color=green];
1481[label="89.113.128.161s;115pkt 115fpkt", shape=triangle, color=blue];
4063[label="89.113.128.161;156pkt 156fpkt", shape=pentagon, color=darkviolet];
4810[label="89.113.128.161;156pkt 156fpkt", shape=invtriangle, color=brown];
5195[label="89.113.128.161;155pkt 155fpkt", shape=invhouse, color=bisque];
stat1083[shape=component, label=&lt;Rules:&lt;BR/&gt;{89.113.128.161:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
445--1041[label="1;115pkt 115fpkt"];
445--1481[label="1;115pkt 115fpkt"];
445--4063[label="1;153pkt 153fpkt"];
445--4810[label="1;153pkt 153fpkt"];
445--5195[label="0.993464;152pkt 152fpkt"];
1041--1481[label="1;115pkt 115fpkt"];
1041--4063[label="1;115pkt 115fpkt"];
1041--4810[label="1;115pkt 115fpkt"];
1041--5195[label="0.991304;114pkt 114fpkt"];
1481--4063[label="1;115pkt 115fpkt"];
1481--4810[label="1;115pkt 115fpkt"];
1481--5195[label="0.991304;114pkt 114fpkt"];
4063--4810[label="1;156pkt 156fpkt"];
4063--5195[label="1;155pkt 155fpkt"];
4810--5195[label="1;155pkt 155fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="89.113.128.161" src_port="1025"/>
    </slice>
    <from sec="1041398357" usec="0"/>
    <to sec="1041398384" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="208.184.170.161"/>
    </slice>
    <from sec="1041398241" usec="0"/>
    <to sec="1041398289" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1085{
style=filled;
color=gray75;
4068[label="91.85.195.162;116pkt 116fpkt", shape=pentagon, color=darkviolet];
4812[label="91.85.195.162;115pkt 115fpkt", shape=invtriangle, color=brown];
stat1085[shape=component, label=&lt;Rules:&lt;BR/&gt;{91.85.195.162:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
4068--4812[label="1;115pkt 115fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="91.85.195.162" src_port="1028"/>
    </slice>
    <from sec="1041397759" usec="0"/>
    <to sec="1041397778" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.969076,1.91301,002,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1086{
style=filled;
color=gray75;
462[label="212.210.141.170s;116pkt 116fpkt", shape=rectangle, color=red];
4103[label="212.210.141.170;116pkt 116fpkt", shape=pentagon, color=darkviolet];
4826[label="212.210.141.170;116pkt 116fpkt", shape=invtriangle, color=brown];
5203[label="212.210.141.170;116pkt 116fpkt", shape=invhouse, color=bisque];
stat1086[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.210.141.170:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
462--4103[label="1;116pkt 116fpkt"];
462--4826[label="1;116pkt 116fpkt"];
462--5203[label="1;116pkt 116fpkt"];
4103--4826[label="1;116pkt 116fpkt"];
4103--5203[label="1;116pkt 116fpkt"];
4826--5203[label="1;116pkt 116fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="212.210.141.170" src_port="1028"/>
    </slice>
    <from sec="1041397843" usec="0"/>
    <to sec="1041397865" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11432,1.97571,999,0 0 0 1 1 0 0 0 0 0 1 0 ">
    <description>subgraph cluster_1087{
style=filled;
color=gray75;
2523[label="192.128.206.170;s;130pkt 130fpkt", shape=diamond, color=yellow];
3194[label="192.128.206.170;s;130pkt 130fpkt", shape=hexagon, color=black];
4827[label="192.128.206.170;134pkt 134fpkt", shape=invtriangle, color=brown];
stat1087[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.128.206.170:53, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (50.3807%)&lt;BR/&gt; 2762: (0.761421%)&lt;BR/&gt; 1458: (0.761421%)&lt;BR/&gt; 55773: (0.380711%)&lt;BR/&gt; 53748: (0.380711%)&gt;];
}
2523--3194[label="1;130pkt 130fpkt"];
2523--4827[label="0.984615;128pkt 128fpkt"];
3194--4827[label="0.984615;128pkt 128fpkt"];
</description>
    <slice>
      <filter src_ip="192.128.206.170" src_port="53"/>
    </slice>
    <from sec="1041397201" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1088{
style=filled;
color=gray75;
4114[label="192.128.206.172;156pkt 156fpkt", shape=pentagon, color=darkviolet];
4831[label="192.128.206.172;157pkt 157fpkt", shape=invtriangle, color=brown];
stat1088[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.128.206.172:53, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (50%)&lt;BR/&gt; 4301: (0.638978%)&lt;BR/&gt; 2741: (0.638978%)&lt;BR/&gt; 1455: (0.638978%)&lt;BR/&gt; 1025: (0.638978%)&gt;];
}
4114--4831[label="1;156pkt 156fpkt"];
</description>
    <slice>
      <filter src_ip="192.128.206.172" src_port="53"/>
    </slice>
    <from sec="1041397250" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="216.239.104.174"/>
    </slice>
    <from sec="1041397239" usec="0"/>
    <to sec="1041398821" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="210.134.137.175"/>
    </slice>
    <from sec="1041398761" usec="0"/>
    <to sec="1041398788" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1091{
style=filled;
color=gray75;
4128[label="192.58.114.177;33pkt 33fpkt", shape=pentagon, color=darkviolet];
4840[label="192.58.114.177;33pkt 33fpkt", shape=invtriangle, color=brown];
stat1091[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.58.114.177:80, 217.77.96.62:*}[48.4848%]&lt;BR/&gt;{192.58.114.177:80, 200.78.143.189:*}[48.4848%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.4848%)&lt;BR/&gt; 38647: (1.51515%)&lt;BR/&gt; 4708: (1.51515%)&lt;BR/&gt; 4705: (1.51515%)&lt;BR/&gt; 4702: (1.51515%)&gt;];
}
4128--4840[label="1;33pkt 33fpkt"];
</description>
    <slice>
      <filter dst_ip="200.78.143.189" src_ip="192.58.114.177" src_port="80"/>
      <filter dst_ip="217.77.96.62" src_ip="192.58.114.177" src_port="80"/>
    </slice>
    <from sec="1041397949" usec="0"/>
    <to sec="1041398454" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.13055,1.89529,999,1 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1092{
style=filled;
color=gray75;
488[label="90.18.170.186s;1pkt 1fpkt", shape=rectangle, color=red];
1948[label="61.135.90.178;s;5pkt 5fpkt", shape=diamond, color=yellow];
2008[label="168.125.84.82;d;16pkt 16fpkt", shape=diamond, color=yellow];
2706[label="61.135.90.186;s;2pkt 2fpkt", shape=diamond, color=yellow];
2820[label="168.125.84.82;d;11pkt 11fpkt", shape=hexagon, color=black];
4133[label="61.135.90.178;4pkt 4fpkt", shape=pentagon, color=darkviolet];
4152[label="61.135.90.186;3pkt 3fpkt", shape=pentagon, color=darkviolet];
4842[label="61.135.90.178;4pkt 4fpkt", shape=invtriangle, color=brown];
4852[label="61.135.90.186;4pkt 4fpkt", shape=invtriangle, color=brown];
stat1092[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.135.90.176:6121, 168.125.84.82:*}[20%]&lt;BR/&gt;{61.135.90.178:5121, 168.125.84.82:*}[20%]&lt;BR/&gt;{*:5121, 168.125.84.164:*}[20%]&lt;BR/&gt;{61.135.90.186:5121, *:*}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5121: (31%)&lt;BR/&gt; 6121: (6%)&lt;BR/&gt; 80: (6%)&lt;BR/&gt; 1423: (5%)&lt;BR/&gt; 1413: (5%)&gt;];
}
488--2008[label="1;1pkt 1fpkt"];
488--2706[label="1;1pkt 1fpkt"];
488--2820[label="1;1pkt 1fpkt"];
488--4852[label="1;1pkt 1fpkt"];
1948--2008[label="0.8;4pkt 4fpkt"];
1948--2820[label="0.4;2pkt 2fpkt"];
1948--4133[label="1;4pkt 4fpkt"];
1948--4842[label="1;4pkt 4fpkt"];
2008--2706[label="0.5;1pkt 1fpkt"];
2008--2820[label="1;11pkt 11fpkt"];
2008--4133[label="0.75;3pkt 3fpkt"];
2008--4842[label="0.75;3pkt 3fpkt"];
2008--4852[label="0.25;1pkt 1fpkt"];
2706--2820[label="0.5;1pkt 1fpkt"];
2706--4152[label="0.5;1pkt 1fpkt"];
2706--4852[label="1;2pkt 2fpkt"];
2820--4133[label="0.25;1pkt 1fpkt"];
2820--4842[label="0.25;1pkt 1fpkt"];
2820--4852[label="0.25;1pkt 1fpkt"];
4133--4842[label="1;4pkt 4fpkt"];
4152--4852[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter src_ip="61.135.90.186" src_port="5121"/>
      <filter dst_ip="168.125.84.164" src_port="5121"/>
      <filter dst_ip="168.125.84.82" src_ip="61.135.90.178" src_port="5121"/>
      <filter dst_ip="168.125.84.82" src_ip="61.135.90.176" src_port="6121"/>
    </slice>
    <from sec="1041397203" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="203.102.50.179"/>
    </slice>
    <from sec="1041397203" usec="0"/>
    <to sec="1041398820" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1094{
style=filled;
color=gray75;
4144[label="202.32.33.183;104pkt 104fpkt", shape=pentagon, color=darkviolet];
4846[label="202.32.33.183;105pkt 105fpkt", shape=invtriangle, color=brown];
stat1094[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.32.33.183:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
4144--4846[label="1;104pkt 104fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="202.32.33.183" src_port="1027"/>
    </slice>
    <from sec="1041398646" usec="0"/>
    <to sec="1041398682" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="61.135.93.184"/>
    </slice>
    <from sec="1041397321" usec="0"/>
    <to sec="1041398718" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.864077,1.95291,503,0 0 0 1 0 0 0 0 0 0 1 0 ">
    <description>subgraph cluster_1096{
style=filled;
color=gray75;
2118[label="149.68.129.225;d;12pkt 12fpkt", shape=diamond, color=yellow];
2119[label="202.159.53.191;s;12pkt 12fpkt", shape=diamond, color=yellow];
4858[label="202.159.53.191;24pkt 24fpkt", shape=invtriangle, color=brown];
stat1096[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.159.53.191:*, 149.68.129.225:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 64860: (3.125%)&lt;BR/&gt; 64859: (3.125%)&lt;BR/&gt; 64858: (3.125%)&lt;BR/&gt; 64857: (3.125%)&gt;];
}
2118--2119[label="1;12pkt 12fpkt"];
2118--4858[label="1;12pkt 12fpkt"];
2119--4858[label="1;12pkt 12fpkt"];
</description>
    <slice>
      <filter dst_ip="149.68.129.225" dst_port="80" src_ip="202.159.53.191"/>
    </slice>
    <from sec="1041397221" usec="0"/>
    <to sec="1041398047" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="202.159.200.192"/>
    </slice>
    <from sec="1041397471" usec="0"/>
    <to sec="1041397499" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="89.193.149.194"/>
    </slice>
    <from sec="1041397270" usec="0"/>
    <to sec="1041397589" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="91.97.9.195"/>
    </slice>
    <from sec="1041397206" usec="0"/>
    <to sec="1041398821" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,502,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="216.204.28.196"/>
    </slice>
    <from sec="1041398415" usec="0"/>
    <to sec="1041398511" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1101{
style=filled;
color=gray75;
4184[label="88.162.128.196;12pkt 12fpkt", shape=pentagon, color=darkviolet];
4874[label="88.162.128.196;12pkt 12fpkt", shape=invtriangle, color=brown];
stat1101[shape=component, label=&lt;Rules:&lt;BR/&gt;{88.162.128.196:80, 202.159.192.25:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 8607: (4.16667%)&lt;BR/&gt; 8530: (4.16667%)&lt;BR/&gt; 3564: (4.16667%)&lt;BR/&gt; 3559: (4.16667%)&gt;];
}
4184--4874[label="1;12pkt 12fpkt"];
</description>
    <slice>
      <filter dst_ip="202.159.192.25" src_ip="88.162.128.196" src_port="80"/>
    </slice>
    <from sec="1041397783" usec="0"/>
    <to sec="1041398432" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="200.1.136.199"/>
    </slice>
    <from sec="1041397964" usec="0"/>
    <to sec="1041397976" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,020,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1103{
style=filled;
color=gray75;
4200[label="203.59.22.200;16pkt 16fpkt", shape=pentagon, color=darkviolet];
4885[label="203.59.22.200;16pkt 16fpkt", shape=invtriangle, color=brown];
stat1103[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.59.22.200:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
4200--4885[label="1;16pkt 16fpkt"];
</description>
    <slice>
      <filter src_ip="203.59.22.200"/>
    </slice>
    <from sec="1041397213" usec="0"/>
    <to sec="1041398820" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1104{
style=filled;
color=gray75;
4210[label="210.64.233.201;13pkt 13fpkt", shape=pentagon, color=darkviolet];
4893[label="210.64.233.201;14pkt 14fpkt", shape=invtriangle, color=brown];
stat1104[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.64.233.201:80, 148.155.128.230:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4333: (3.7037%)&lt;BR/&gt; 4332: (3.7037%)&lt;BR/&gt; 4331: (3.7037%)&lt;BR/&gt; 4324: (3.7037%)&gt;];
}
4210--4893[label="1;13pkt 13fpkt"];
</description>
    <slice>
      <filter dst_ip="148.155.128.230" src_ip="210.64.233.201" src_port="80"/>
    </slice>
    <from sec="1041398722" usec="0"/>
    <to sec="1041398746" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1105{
style=filled;
color=gray75;
4226[label="4.174.136.205;235pkt 235fpkt", shape=pentagon, color=darkviolet];
4900[label="4.174.136.205;235pkt 235fpkt", shape=invtriangle, color=brown];
stat1105[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.174.136.205:1028, *:137}[80.8511%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 1028: (40.4255%)&lt;BR/&gt; 1026: (9.57447%)&gt;];
}
4226--4900[label="1;235pkt 235fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="4.174.136.205" src_port="1028"/>
    </slice>
    <from sec="1041397270" usec="0"/>
    <to sec="1041397933" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.873736,1.91329,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1106{
style=filled;
color=gray75;
2497[label="136.234.170.208;s;35pkt 35fpkt", shape=diamond, color=yellow];
4236[label="136.234.170.208;43pkt 43fpkt", shape=pentagon, color=darkviolet];
4905[label="136.234.170.208;43pkt 43fpkt", shape=invtriangle, color=brown];
stat1106[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.170.208:*, 205.6.11.12:80}[27.2727%]&lt;BR/&gt;{136.234.170.208:*, 217.21.160.5:80}[22.7273%]&lt;BR/&gt;{136.234.170.208:*, 90.89.209.6:443}[20.4545%]&lt;BR/&gt;{136.234.170.208:*, 61.247.37.111:80}[20.4545%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (38.843%)&lt;BR/&gt; 443: (11.157%)&lt;BR/&gt; 1847: (1.23967%)&lt;BR/&gt; 1845: (1.23967%)&lt;BR/&gt; 1844: (1.23967%)&gt;];
}
2497--3279[label="0.0285714;1pkt 1fpkt"];
2497--3283[label="0.0285714;1pkt 1fpkt"];
2497--3294[label="0.0285714;1pkt 1fpkt"];
2497--4236[label="0.971429;34pkt 34fpkt"];
2497--4905[label="0.971429;34pkt 34fpkt"];
4236--4905[label="1;43pkt 43fpkt"];
</description>
    <slice>
      <filter dst_ip="205.6.11.12" dst_port="80" src_ip="136.234.170.208"/>
      <filter dst_ip="217.21.160.5" dst_port="80" src_ip="136.234.170.208"/>
      <filter dst_ip="61.247.37.111" dst_port="80" src_ip="136.234.170.208"/>
      <filter dst_ip="90.89.209.6" dst_port="443" src_ip="136.234.170.208"/>
    </slice>
    <from sec="1041397403" usec="0"/>
    <to sec="1041398671" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.958875,1.95391,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1107{
style=filled;
color=gray75;
4237[label="211.104.242.208;16pkt 16fpkt", shape=pentagon, color=darkviolet];
4906[label="211.104.242.208;16pkt 16fpkt", shape=invtriangle, color=brown];
5238[label="211.104.242.208;16pkt 16fpkt", shape=invhouse, color=bisque];
stat1107[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.104.242.208:80, 168.125.224.167:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 50552: (3.125%)&lt;BR/&gt; 50551: (3.125%)&lt;BR/&gt; 50550: (3.125%)&lt;BR/&gt; 50549: (3.125%)&gt;];
}
4237--4906[label="1;16pkt 16fpkt"];
4237--5238[label="1;16pkt 16fpkt"];
4906--5238[label="1;16pkt 16fpkt"];
</description>
    <slice>
      <filter dst_ip="168.125.224.167" src_ip="211.104.242.208" src_port="80"/>
    </slice>
    <from sec="1041397227" usec="0"/>
    <to sec="1041397355" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.10027,1.95018,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1108{
style=filled;
color=gray75;
2162[label="193.26.236.72;d;158pkt 158fpkt", shape=diamond, color=yellow];
2163[label="202.20.18.209;s;72pkt 72fpkt", shape=diamond, color=yellow];
4239[label="202.20.18.209;212pkt 212fpkt", shape=pentagon, color=darkviolet];
4907[label="202.20.18.209;212pkt 212fpkt", shape=invtriangle, color=brown];
5239[label="202.20.18.209;211pkt 211fpkt", shape=invhouse, color=bisque];
stat1108[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.20.18.209:*, 193.26.236.72:113}[50%]&lt;BR/&gt;{202.20.18.209:25, 193.26.236.72:*}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 113: (25.0289%)&lt;BR/&gt; 25: (24.9711%)&lt;BR/&gt; 35872: (0.289017%)&lt;BR/&gt; 35865: (0.289017%)&lt;BR/&gt; 35859: (0.289017%)&gt;];
}
2162--2163[label="1;72pkt 72fpkt"];
2162--4239[label="1;158pkt 158fpkt"];
2162--4907[label="1;158pkt 158fpkt"];
2162--5239[label="1;158pkt 158fpkt"];
2163--4239[label="1;72pkt 72fpkt"];
2163--4907[label="1;72pkt 72fpkt"];
2163--5239[label="1;72pkt 72fpkt"];
4239--4907[label="1;212pkt 212fpkt"];
4239--5239[label="1;211pkt 211fpkt"];
4907--5239[label="1;211pkt 211fpkt"];
</description>
    <slice>
      <filter dst_ip="193.26.236.72" src_ip="202.20.18.209" src_port="25"/>
      <filter dst_ip="193.26.236.72" dst_port="113" src_ip="202.20.18.209"/>
    </slice>
    <from sec="1041397237" usec="0"/>
    <to sec="1041398212" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="205.65.249.212"/>
    </slice>
    <from sec="1041398823" usec="0"/>
    <to sec="1041398824" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.10027,1.95018,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1110{
style=filled;
color=gray75;
2720[label="210.89.0.215;s;10pkt 10fpkt", shape=diamond, color=yellow];
4259[label="210.89.0.215;9pkt 9fpkt", shape=pentagon, color=darkviolet];
4918[label="210.89.0.215;9pkt 9fpkt", shape=invtriangle, color=brown];
5244[label="210.89.0.215;9pkt 9fpkt", shape=invhouse, color=bisque];
stat1110[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.89.0.215:*, 172.142.193.97:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1235: (5.40541%)&lt;BR/&gt; 1234: (5.40541%)&lt;BR/&gt; 1233: (5.40541%)&lt;BR/&gt; 1232: (5.40541%)&gt;];
}
2720--3283[label="0.4;4pkt 4fpkt"];
2720--4259[label="1;9pkt 9fpkt"];
2720--4918[label="1;9pkt 9fpkt"];
2720--5244[label="1;9pkt 9fpkt"];
4259--4918[label="1;9pkt 9fpkt"];
4259--5244[label="1;9pkt 9fpkt"];
4918--5244[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="172.142.193.97" dst_port="80" src_ip="210.89.0.215"/>
    </slice>
    <from sec="1041398615" usec="0"/>
    <to sec="1041398728" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.10027,1.95018,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1111{
style=filled;
color=gray75;
1640[label="192.163.103.123;d;33pkt 33fpkt", shape=diamond, color=yellow];
1642[label="168.125.242.215;s;70pkt 70fpkt", shape=diamond, color=yellow];
1757[label="192.163.103.115;d;2pkt 2fpkt", shape=diamond, color=yellow];
4267[label="168.125.242.215;70pkt 70fpkt", shape=pentagon, color=darkviolet];
4923[label="168.125.242.215;70pkt 70fpkt", shape=invtriangle, color=brown];
5247[label="168.125.242.215;70pkt 70fpkt", shape=invhouse, color=bisque];
stat1111[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.125.242.215:*, 192.163.103.115:80}[52.7778%]&lt;BR/&gt;{168.125.242.215:*, 192.163.103.123:80}[44.4444%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 49329: (0.793651%)&lt;BR/&gt; 49328: (0.793651%)&lt;BR/&gt; 49327: (0.793651%)&lt;BR/&gt; 49326: (0.793651%)&gt;];
}
1640--1642[label="0.969697;32pkt 32fpkt"];
1640--1750[label="0.030303;1pkt 1fpkt"];
1640--3275[label="0.121212;4pkt 4fpkt"];
1640--3289[label="0.121212;4pkt 4fpkt"];
1640--3298[label="0.121212;4pkt 4fpkt"];
1640--4267[label="0.969697;32pkt 32fpkt"];
1640--4923[label="0.969697;32pkt 32fpkt"];
1640--5247[label="0.969697;32pkt 32fpkt"];
1642--1757[label="0.5;1pkt 1fpkt"];
1642--3275[label="0.442857;31pkt 31fpkt"];
1642--3289[label="0.442857;31pkt 31fpkt"];
1642--3298[label="0.442857;31pkt 31fpkt"];
1642--4267[label="1;70pkt 70fpkt"];
1642--4923[label="1;70pkt 70fpkt"];
1642--5247[label="1;70pkt 70fpkt"];
1757--2769[label="1;1pkt 1fpkt"];
1757--3275[label="0.5;1pkt 1fpkt"];
1757--3289[label="0.5;1pkt 1fpkt"];
1757--3298[label="0.5;1pkt 1fpkt"];
1757--4267[label="0.5;1pkt 1fpkt"];
1757--4923[label="0.5;1pkt 1fpkt"];
1757--5247[label="0.5;1pkt 1fpkt"];
4267--4923[label="1;70pkt 70fpkt"];
4267--5247[label="1;70pkt 70fpkt"];
4923--5247[label="1;70pkt 70fpkt"];
</description>
    <slice>
      <filter dst_ip="192.163.103.115" dst_port="80" src_ip="168.125.242.215"/>
      <filter dst_ip="192.163.103.123" dst_port="80" src_ip="168.125.242.215"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041397731" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="205.172.9.216"/>
    </slice>
    <from sec="1041398551" usec="0"/>
    <to sec="1041398560" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.958875,1.95391,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1113{
style=filled;
color=gray75;
4275[label="202.145.29.217;42pkt 42fpkt", shape=pentagon, color=darkviolet];
4925[label="202.145.29.217;41pkt 41fpkt", shape=invtriangle, color=brown];
5249[label="202.145.29.217;42pkt 42fpkt", shape=invhouse, color=bisque];
stat1113[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.145.29.217:*, 61.89.134.151:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3655: (1.2%)&lt;BR/&gt; 3654: (1.2%)&lt;BR/&gt; 3653: (1.2%)&lt;BR/&gt; 3652: (1.2%)&gt;];
}
4275--4925[label="1;41pkt 41fpkt"];
4275--5249[label="1;42pkt 42fpkt"];
4925--5249[label="1;41pkt 41fpkt"];
</description>
    <slice>
      <filter dst_ip="61.89.134.151" dst_port="80" src_ip="202.145.29.217"/>
    </slice>
    <from sec="1041398812" usec="0"/>
    <to sec="1041398820" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1114{
style=filled;
color=gray75;
4277[label="148.155.56.217;28pkt 28fpkt", shape=pentagon, color=darkviolet];
4926[label="148.155.56.217;28pkt 28fpkt", shape=invtriangle, color=brown];
stat1114[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.155.56.217:*, 205.65.232.204:80}[82.1429%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1114: (1.78571%)&lt;BR/&gt; 1113: (1.78571%)&lt;BR/&gt; 1097: (1.78571%)&lt;BR/&gt; 1088: (1.78571%)&gt;];
}
4277--4926[label="1;28pkt 28fpkt"];
</description>
    <slice>
      <filter dst_ip="205.65.232.204" dst_port="80" src_ip="148.155.56.217"/>
    </slice>
    <from sec="1041397279" usec="0"/>
    <to sec="1041397981" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="205.65.20.220"/>
    </slice>
    <from sec="1041398055" usec="0"/>
    <to sec="1041398794" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1116{
style=filled;
color=gray75;
4295[label="210.168.204.220;16pkt 16fpkt", shape=pentagon, color=darkviolet];
4935[label="210.168.204.220;15pkt 15fpkt", shape=invtriangle, color=brown];
stat1116[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.168.204.220:*, 136.146.97.208:2065}[50%]&lt;BR/&gt;{210.168.204.220:*, 136.146.97.211:2065}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2065: (50%)&lt;BR/&gt; 45643: (3.22581%)&lt;BR/&gt; 45642: (3.22581%)&lt;BR/&gt; 45309: (3.22581%)&lt;BR/&gt; 45308: (3.22581%)&gt;];
}
4295--4935[label="1;15pkt 15fpkt"];
</description>
    <slice>
      <filter dst_ip="136.146.97.211" dst_port="2065" src_ip="210.168.204.220"/>
      <filter dst_ip="136.146.97.208" dst_port="2065" src_ip="210.168.204.220"/>
    </slice>
    <from sec="1041397226" usec="0"/>
    <to sec="1041398817" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="70.161.33.221"/>
    </slice>
    <from sec="1041397203" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687214,1.91709,011,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1118{
style=filled;
color=gray75;
4299[label="136.234.103.222;23pkt 23fpkt", shape=pentagon, color=darkviolet];
4939[label="136.234.103.222;23pkt 23fpkt", shape=invtriangle, color=brown];
stat1118[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.234.103.222:6346, 90.6.96.127:*}[69.5652%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6346: (43.4783%)&lt;BR/&gt; 7070: (2.17391%)&lt;BR/&gt; 6970: (2.17391%)&lt;BR/&gt; 6770: (2.17391%)&lt;BR/&gt; 5100: (2.17391%)&gt;];
}
4299--4939[label="1;23pkt 23fpkt"];
</description>
    <slice>
      <filter dst_ip="90.6.96.127" src_ip="136.234.103.222" src_port="6346"/>
    </slice>
    <from sec="1041397205" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.873736,1.91329,010,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_1119{
style=filled;
color=gray75;
2222[label="172.142.141.222;s;607pkt 607fpkt", shape=diamond, color=yellow];
4300[label="172.142.141.222;607pkt 607fpkt", shape=pentagon, color=darkviolet];
4940[label="172.142.141.222;604pkt 604fpkt", shape=invtriangle, color=brown];
stat1119[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.142.141.222:*, *:25}[94.8929%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (47.5248%)&lt;BR/&gt; 113: (2.47525%)&lt;BR/&gt; 2845: (0.165017%)&lt;BR/&gt; 2808: (0.165017%)&lt;BR/&gt; 64113: (0.0825083%)&gt;];
}
2222--4300[label="1;607pkt 607fpkt"];
2222--4940[label="1;604pkt 604fpkt"];
4300--4940[label="1;604pkt 604fpkt"];
</description>
    <slice>
      <filter dst_port="25" src_ip="172.142.141.222"/>
    </slice>
    <from sec="1041397200" usec="0"/>
    <to sec="1041398786" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="200.49.131.227"/>
    </slice>
    <from sec="1041398227" usec="0"/>
    <to sec="1041398311" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.958875,1.95391,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1121{
style=filled;
color=gray75;
4319[label="218.37.78.228;5pkt 5fpkt", shape=pentagon, color=darkviolet];
4950[label="218.37.78.228;5pkt 5fpkt", shape=invtriangle, color=brown];
5266[label="218.37.78.228;5pkt 5fpkt", shape=invhouse, color=bisque];
stat1121[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.37.78.228:6179, 192.59.187.184:25}[20%]&lt;BR/&gt;{218.37.78.228:63655, 192.59.187.184:25}[20%]&lt;BR/&gt;{218.37.78.228:113, 192.59.187.184:4526}[20%]&lt;BR/&gt;{218.37.78.228:113, 192.59.187.184:4570}[20%]&lt;BR/&gt;{218.37.78.228:113, 192.59.187.184:4671}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 113: (30%)&lt;BR/&gt; 25: (20%)&lt;BR/&gt; 63655: (10%)&lt;BR/&gt; 6179: (10%)&lt;BR/&gt; 4671: (10%)&gt;];
}
4319--4950[label="1;5pkt 5fpkt"];
4319--5266[label="1;5pkt 5fpkt"];
4950--5266[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="192.59.187.184" dst_port="4671" src_ip="218.37.78.228" src_port="113"/>
      <filter dst_ip="192.59.187.184" dst_port="4570" src_ip="218.37.78.228" src_port="113"/>
      <filter dst_ip="192.59.187.184" dst_port="4526" src_ip="218.37.78.228" src_port="113"/>
      <filter dst_ip="192.59.187.184" dst_port="25" src_ip="218.37.78.228" src_port="63655"/>
      <filter dst_ip="192.59.187.184" dst_port="25" src_ip="218.37.78.228" src_port="6179"/>
    </slice>
    <from sec="1041397435" usec="0"/>
    <to sec="1041398452" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.30601,1.97302,503,0 0 0 1 1 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1122{
style=filled;
color=gray75;
2009[label="136.146.36.172;d;175pkt 175fpkt", shape=diamond, color=yellow];
3023[label="136.146.36.172;d;139pkt 139fpkt", shape=hexagon, color=black];
4303[label="211.35.119.223;40pkt 40fpkt", shape=pentagon, color=darkviolet];
4321[label="211.104.242.228;8pkt 8fpkt", shape=pentagon, color=darkviolet];
4942[label="211.35.119.223;40pkt 40fpkt", shape=invtriangle, color=brown];
4951[label="211.104.242.228;8pkt 8fpkt", shape=invtriangle, color=brown];
5259[label="211.35.119.223;40pkt 40fpkt", shape=invhouse, color=bisque];
stat1122[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.35.119.223:80, 136.146.36.172:*}[21.978%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.7778%)&lt;BR/&gt; 42806: (0.555556%)&lt;BR/&gt; 42804: (0.555556%)&lt;BR/&gt; 42803: (0.555556%)&lt;BR/&gt; 42802: (0.555556%)&gt;];
}
2009--3023[label="1;139pkt 139fpkt"];
2009--3464[label="0.0392157;2pkt 2fpkt"];
2009--3647[label="0.454545;5pkt 5fpkt"];
2009--3654[label="0.02;1pkt 1fpkt"];
2009--3831[label="0.0769231;1pkt 1fpkt"];
2009--4033[label="0.0192308;1pkt 1fpkt"];
2009--4126[label="0.0535714;3pkt 3fpkt"];
2009--4303[label="1;40pkt 40fpkt"];
2009--4321[label="0.125;1pkt 1fpkt"];
2009--4487[label="0.0392157;2pkt 2fpkt"];
2009--4793[label="0.0188679;1pkt 1fpkt"];
2009--4942[label="1;40pkt 40fpkt"];
2009--4951[label="0.125;1pkt 1fpkt"];
2009--5031[label="0.0384615;2pkt 2fpkt"];
2009--5188[label="0.0188679;1pkt 1fpkt"];
2009--5259[label="1;40pkt 40fpkt"];
3023--3464[label="0.0196078;1pkt 1fpkt"];
3023--3647[label="0.454545;5pkt 5fpkt"];
3023--3654[label="0.02;1pkt 1fpkt"];
3023--3831[label="0.0769231;1pkt 1fpkt"];
3023--4033[label="0.0192308;1pkt 1fpkt"];
3023--4126[label="0.0535714;3pkt 3fpkt"];
3023--4303[label="1;40pkt 40fpkt"];
3023--4321[label="0.125;1pkt 1fpkt"];
3023--4487[label="0.0196078;1pkt 1fpkt"];
3023--4793[label="0.0188679;1pkt 1fpkt"];
3023--4942[label="1;40pkt 40fpkt"];
3023--4951[label="0.125;1pkt 1fpkt"];
3023--5031[label="0.0192308;1pkt 1fpkt"];
3023--5188[label="0.0188679;1pkt 1fpkt"];
3023--5259[label="1;40pkt 40fpkt"];
4303--4942[label="1;40pkt 40fpkt"];
4303--5259[label="1;40pkt 40fpkt"];
4321--4951[label="1;8pkt 8fpkt"];
4942--5259[label="1;40pkt 40fpkt"];
</description>
    <slice>
      <filter dst_ip="136.146.36.172" src_ip="211.35.119.223" src_port="80"/>
    </slice>
    <from sec="1041397203" usec="0"/>
    <to sec="1041398748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="205.65.20.229"/>
    </slice>
    <from sec="1041397219" usec="0"/>
    <to sec="1041398822" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.958875,1.95391,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1124{
style=filled;
color=gray75;
4331[label="170.9.128.231;5pkt 5fpkt", shape=pentagon, color=darkviolet];
4958[label="170.9.128.231;4pkt 4fpkt", shape=invtriangle, color=brown];
5271[label="170.9.128.231;4pkt 4fpkt", shape=invhouse, color=bisque];
stat1124[shape=component, label=&lt;Rules:&lt;BR/&gt;{170.9.128.231:80, 88.212.112.129:22991}[20%]&lt;BR/&gt;{170.9.128.231:80, 90.184.141.5:4389}[20%]&lt;BR/&gt;{170.9.128.231:80, 90.184.141.5:4391}[20%]&lt;BR/&gt;{170.9.128.231:80, 88.212.112.137:25594}[20%]&lt;BR/&gt;{170.9.128.231:80, 88.212.112.137:25758}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 25758: (11.5385%)&lt;BR/&gt; 25594: (11.5385%)&lt;BR/&gt; 22991: (11.5385%)&lt;BR/&gt; 4389: (11.5385%)&gt;];
}
4331--4958[label="1;4pkt 4fpkt"];
4331--5271[label="1;4pkt 4fpkt"];
4958--5271[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="88.212.112.137" dst_port="25758" src_ip="170.9.128.231" src_port="80"/>
      <filter dst_ip="88.212.112.137" dst_port="25594" src_ip="170.9.128.231" src_port="80"/>
      <filter dst_ip="90.184.141.5" dst_port="4391" src_ip="170.9.128.231" src_port="80"/>
      <filter dst_ip="90.184.141.5" dst_port="4389" src_ip="170.9.128.231" src_port="80"/>
      <filter dst_ip="88.212.112.129" dst_port="22991" src_ip="170.9.128.231" src_port="80"/>
    </slice>
    <from sec="1041397259" usec="0"/>
    <to sec="1041398013" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="205.65.20.234"/>
    </slice>
    <from sec="1041397211" usec="0"/>
    <to sec="1041398052" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11428,1.85956,002,1 1 1 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1126{
style=filled;
color=gray75;
585[label="206.61.113.238s;211pkt 211fpkt", shape=rectangle, color=red];
1149[label="206.61.113.238s;211pkt 211fpkt", shape=ellipse, color=green];
1558[label="206.61.113.238s;211pkt 211fpkt", shape=triangle, color=blue];
4352[label="206.61.113.238;214pkt 214fpkt", shape=pentagon, color=darkviolet];
4967[label="206.61.113.238;213pkt 213fpkt", shape=invtriangle, color=brown];
5275[label="206.61.113.238;213pkt 213fpkt", shape=invhouse, color=bisque];
stat1126[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.61.113.238:9223, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9223: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
585--1149[label="1;211pkt 211fpkt"];
585--1558[label="1;211pkt 211fpkt"];
585--4352[label="1;211pkt 211fpkt"];
585--4967[label="0.995261;210pkt 210fpkt"];
585--5275[label="0.995261;210pkt 210fpkt"];
1149--1558[label="1;211pkt 211fpkt"];
1149--4352[label="1;211pkt 211fpkt"];
1149--4967[label="0.995261;210pkt 210fpkt"];
1149--5275[label="0.995261;210pkt 210fpkt"];
1558--4352[label="1;211pkt 211fpkt"];
1558--4967[label="0.995261;210pkt 210fpkt"];
1558--5275[label="0.995261;210pkt 210fpkt"];
4352--4967[label="1;213pkt 213fpkt"];
4352--5275[label="1;213pkt 213fpkt"];
4967--5275[label="1;213pkt 213fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="206.61.113.238" src_port="9223"/>
    </slice>
    <from sec="1041398695" usec="0"/>
    <to sec="1041398728" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.674891,1.95663,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="205.65.20.249"/>
    </slice>
    <from sec="1041397581" usec="0"/>
    <to sec="1041398813" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.958875,1.95391,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_1128{
style=filled;
color=gray75;
4394[label="218.149.90.253;20pkt 20fpkt", shape=pentagon, color=darkviolet];
4987[label="218.149.90.253;20pkt 20fpkt", shape=invtriangle, color=brown];
5290[label="218.149.90.253;19pkt 19fpkt", shape=invhouse, color=bisque];
stat1128[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.149.90.253:80, 148.155.58.155:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1235: (2.54237%)&lt;BR/&gt; 1234: (2.54237%)&lt;BR/&gt; 1233: (2.54237%)&lt;BR/&gt; 1232: (2.54237%)&gt;];
}
4394--4987[label="1;20pkt 20fpkt"];
4394--5290[label="1;19pkt 19fpkt"];
4987--5290[label="1;19pkt 19fpkt"];
</description>
    <slice>
      <filter dst_ip="148.155.58.155" src_ip="218.149.90.253" src_port="80"/>
    </slice>
    <from sec="1041397604" usec="0"/>
    <to sec="1041397639" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547396,1.93306,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_1129{
style=filled;
color=gray75;
3305[label="217.128.173.0;163pkt 163fpkt", shape=pentagon, color=darkviolet];
stat1129[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.128.173.0:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3305--4403[label="1;163pkt 163fpkt"];
3305--4992[label="1;163pkt 163fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="217.128.173.0" src_port="1025"/>
    </slice>
    <from sec="1041397792" usec="0"/>
    <to sec="1041397822" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.854421,2.00808,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="193.95.126.2"/>
    </slice>
    <from sec="1041398303" usec="0"/>
    <to sec="1041398316" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.854421,2.00808,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="148.155.247.8"/>
    </slice>
    <from sec="1041397725" usec="0"/>
    <to sec="1041398086" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.854421,2.00808,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="216.204.21.20"/>
    </slice>
    <from sec="1041398565" usec="0"/>
    <to sec="1041398652" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.854421,2.00808,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="63.21.80.21"/>
    </slice>
    <from sec="1041397695" usec="0"/>
    <to sec="1041397764" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.854421,2.00808,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="207.7.228.22"/>
    </slice>
    <from sec="1041397370" usec="0"/>
    <to sec="1041397835" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.854421,2.00808,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="165.216.234.33"/>
    </slice>
    <from sec="1041397203" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.854421,2.00808,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="165.208.51.40"/>
    </slice>
    <from sec="1041397203" usec="0"/>
    <to sec="1041397374" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.854421,2.00808,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="62.145.114.56"/>
    </slice>
    <from sec="1041397212" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.854421,2.00808,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="153.56.208.56"/>
    </slice>
    <from sec="1041397434" usec="0"/>
    <to sec="1041397438" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.854421,2.00808,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="88.99.219.64"/>
    </slice>
    <from sec="1041398457" usec="0"/>
    <to sec="1041398721" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.854421,2.00808,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="197.182.0.69"/>
    </slice>
    <from sec="1041398202" usec="0"/>
    <to sec="1041398211" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.854421,2.00808,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="90.8.197.87"/>
    </slice>
    <from sec="1041397495" usec="0"/>
    <to sec="1041397628" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.854421,2.00808,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="211.47.98.92"/>
    </slice>
    <from sec="1041397203" usec="0"/>
    <to sec="1041398823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.854421,2.00808,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="205.22.202.100"/>
    </slice>
    <from sec="1041397206" usec="0"/>
    <to sec="1041398810" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.854421,2.00808,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="205.65.22.119"/>
    </slice>
    <from sec="1041397215" usec="0"/>
    <to sec="1041398804" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.854421,2.00808,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="62.122.10.131"/>
    </slice>
    <from sec="1041398701" usec="0"/>
    <to sec="1041398747" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.854421,2.00808,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="145.228.132.137"/>
    </slice>
    <from sec="1041397276" usec="0"/>
    <to sec="1041397283" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.854421,2.00808,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="90.42.154.141"/>
    </slice>
    <from sec="1041397256" usec="0"/>
    <to sec="1041398796" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.854421,2.00808,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="61.135.93.184"/>
    </slice>
    <from sec="1041397321" usec="0"/>
    <to sec="1041398718" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.854421,2.00808,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="202.159.200.192"/>
    </slice>
    <from sec="1041397471" usec="0"/>
    <to sec="1041397499" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.854421,2.00808,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="89.193.149.194"/>
    </slice>
    <from sec="1041397270" usec="0"/>
    <to sec="1041397589" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.854421,2.00808,502,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="216.204.28.196"/>
    </slice>
    <from sec="1041398415" usec="0"/>
    <to sec="1041398511" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.854421,2.00808,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="200.1.136.199"/>
    </slice>
    <from sec="1041397964" usec="0"/>
    <to sec="1041397976" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.854421,2.00808,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="205.172.9.216"/>
    </slice>
    <from sec="1041398551" usec="0"/>
    <to sec="1041398560" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.854421,2.00808,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="200.49.131.227"/>
    </slice>
    <from sec="1041398227" usec="0"/>
    <to sec="1041398311" usec="0"/>
  </anomaly>

</admd:annotation>
